Kernel Log (kern.log)

Location

Description

Kernel ring buffer messages logged to disk capturing hardware events, kernel module loading/unloading, memory errors, device attachment, and security subsystem messages from SELinux/AppArmor.

Forensic Value

Kernel logs reveal rootkit activity through unexpected module loading events and kernel taint flags. USB device attachment events with serial numbers supplement physical access investigations. Out-of-memory (OOM) kill events indicate cryptominer or resource exhaustion attacks. Segmentation faults may indicate active exploitation attempts. Network interface promiscuous mode entries detect packet sniffing.

Tools Required