/Linux Telemetry Reference
Quickly search and reference Linux Logs and Auditd Records.
Local processing
This tool processes your input in your browser.
Command Palette
Search for a command to run...
Filters
Found 7 logs
syslogSystem Daemons Log (/var/log/syslog)
System LogsThe general system logging file for Ubuntu/Debian based systems (or /var/log/messages on RHEL). It captures logs from system daemons, kernel, and various services.
Useful Fields:Timestamp, Hostname, Daemon/Process, Message
Malicious Use:Detecting anomalous service stops/starts, crashes due to exploits, or attackers echoing empty strings to hide tracks.
bash_historyCommand History (~/.bash_history)
System LogsRecords the command line history of bash shell users. Located in each user's home directory.
Useful Fields:Command
Malicious Use:Tracking attacker actions post-compromise. Attackers often run 'history -c' or delete this file to evade detection.
auth.logAuthentication Logs (/var/log/auth.log)
AuthenticationRecords all authentication-related events, including SSH logins, sudo executions, and PAM authentications (or /var/log/secure on RHEL).
Useful Fields:Timestamp, Hostname, Process, Message (User, IP, Success/Fail)
Malicious Use:Detecting SSH brute force attacks, unauthorized root access, or anomalous remote logins.
auditd EXECVECommand Execution (EXECVE)
AuditdGenerated by the Linux Audit Daemon when a process executes a new program (execve system call). It captures the full command line arguments.
Useful Fields:type=EXECVE, argc, a0, a1, a2 (Arguments), pid, uid
Malicious Use:Detecting the execution of malicious scripts, LOLBins (like curl, wget, python), and interactive reverse shells.
auditd USER_LOGINUser Authentication (USER_LOGIN)
AuditdGenerated when a user attempts to log into the system.
Useful Fields:type=USER_LOGIN, auid, uid, res (Success/Failed)
Malicious Use:Tracking successful and failed logins to identify brute force or compromised accounts.
auditd USER_CMDSudo Command (USER_CMD)
AuditdGenerated when a user executes a command via sudo.
Useful Fields:type=USER_CMD, uid, cmd, res
Malicious Use:Monitoring privilege escalation attempts and tracking what commands an attacker runs as root.
auditd SYSCALLSystem Call (SYSCALL)
AuditdThe base record for any audited system call (open, read, write, connect, etc). Used in conjunction with other records.
Useful Fields:type=SYSCALL, syscall, success, exit, pid, uid, comm, exe
Malicious Use:Detecting unauthorized file access (e.g. reading /etc/shadow), network connections from unusual binaries, or modifying critical config files.
Related Tools
Incident Response Playbook Engine
Design and execute structured security incident response workflows.
MITRE ATT&CK Reference
Search and reference common MITRE ATT&CK tactics, techniques, and procedures (TTPs).
Windows Events Reference
Search and reference Windows Security and Sysmon Event IDs.
Incident Report Generator
Create structured IT and cybersecurity incident reports from raw notes, logs, and timelines.