syslog / messages

Location

Description

General-purpose system log aggregating kernel messages, service start/stop events, application logs, hardware events, and daemon output via rsyslog or systemd-journald.

Forensic Value

Syslog provides a chronological backbone for timeline reconstruction. Kernel messages reveal module loading (rootkit insertion), OOM kills (cryptominer resource exhaustion), and device attachment events. Service start/stop entries correlate with attacker persistence mechanisms being activated. When combined with auth.log timestamps, syslog fills the gaps between authentication and process execution.

Tools Required