Essential Linux Commands for Log Analysis

Prepare Sample SSH Log Files

Log download  the log files contain relevant SSH events, including timestamps, source IP addresses, usernames, actions (login, logout), etc.

Commands for Hashing Log Files

1. Generating a Hash (SHA-256)

The most common and secure standard for forensic imaging and log analysis is SHA-256.

• Command: sha256sum ssh.log

  

• Explanation: This command calculates the SHA-256 hash of the file ssh.log. It will output a 64-character hexadecimal string followed by the filename.

2. Saving the Hash to a Verification File

In a forensic investigation, you must save the hash immediately after collecting the evidence.

• Command: sha256sum ssh.log > ssh.log.sha256

  

• Explanation: The > operator redirects the output into a new file named ssh.log.sha256. This file acts as your "Evidence Reference".

3. Verifying the Integrity

To check if the log file has been tampered with or corrupted later:

• Command: sha256sum -c ssh.log.sha256

• Explanation: The -c (check) flag tells the system to read the hash from the .sha256 file and compare it with the current state of ssh.log.

  • Result OK: The file is identical to the original.

    

  • Result FAILED: The file has been modified or corrupted.

Essential Linux Commands for Log Analysis

1. grep (Global Regular Expression Print)

Used to search for specific text patterns within the log file.

• Command: grep "success" ssh.log

• Purpose: To filter and display only the lines where a login was successful.

• Command: grep "failure" ssh.log | wc -l

• Purpose: To count the total number of failed login attempts.

  

Steps to Analyze SSH Log Files

#cat Desktop/Web_Server_Logs/ssh.log 

Analyze failed login attempts:

 #cat Desktop/Web_Server_Logs/ssh.log | grep failure 

Investigate SSH sessions from unusual or suspicious source IP addresses: 

awk (Pattern Scanning and Processing)

Used to extract specific columns (fields) from the log.

• Command: awk '{print $3}' ssh.log

• Purpose: To extract the Source IP address (which is in the 3rd column)

  
  
  

• Command: awk '{print $5}' ssh.log

• Purpose: To extract the Destination IP address (which is in the 5th column).

  
  
  

If you want to find the Top 10 IP addresses trying to hack your server, use this combined

Step-by-step breakdown:

1. awk '{print $3}': Get all Source IPs.

2. sort: Group identical IPs together.

3. uniq -c: Count how many attempts each IP made.

4. sort -nr: Sort numerically in reverse (highest count at the top).

5. head -n 10: Show only the top 10 results.

#awk '{print $3}' Desktop/Web_Server_Logs/ssh.log | sort | uniq -c | sort -nr | head -n 10

Top Target (Destination) IPs:

• 192.168.28.254 (High frequency of attempts)

  
  
  

• 192.168.23.203 (High frequency of attempts)

• 
  
  

• 192.168.27.203 (High frequency of attempts)

• 

1. 1331904022.010000
   → Unix Timestamp (เวลาที่เกิดเหตุการณ์)

2. CU46Bb2UypzdF4eTW
   → Session ID / Connection ID ของ SSH

3. 192.168.202.110
   → Source IP (เครื่องที่พยายามเชื่อมต่อ)

4. 36586
   → Source Port

5. 192.168.27.203
   → Destination IP (เครื่องปลายทาง = SSH Server)

6. 22
   → Destination Port (SSH)

7. undetermined / failure
   → สถานะการเชื่อมต่อ

• undetermined = ยังไม่ทราบผล (handshake)

• failure = login ล้มเหลว

8. INBOUND
   → เป็นการเชื่อมต่อขาเข้า (incoming connection)

9. SSH-2.0-OpenSSH_5.8p1 Debian-ubuntu3
   → Banner ของ SSH 

• The SSH log indicates repeated inbound connection attempts from IP address 192.168.202.110 targeting the SSH service on 192.168.27.203 over port 22.
  Multiple sessions resulted in authentication failures, which is consistent with a brute-force or unauthorized login attempt.

 Time Conversion Command

Since the log uses Unix Epoch Time, you can convert it to a human-readable format using the date command.

• Command: date -d @1332017793.040000 

• Purpose: Converts the timestamp 1332017793.040000  into a standard Date/Time format.

อ่านเพิ่มเติม:

การจัดเก็บ Log file ให้ถูกกฎหมายด้วย 5 เครื่องมือ ใช้งานฟรีๆ

FortiGate Sample logs

หมายเหตุ:เนื้อหาในเว็บไซต์นี้มีขึ้นเพื่อวัตถุประสงค์ในการให้ข้อมูลและเพื่อการศึกษาเท่านั้น ช่วยเตือนความจำ

* หากมีข้อมูลข้อผิดพลาดประการใด ขออภัยมา ณ ที่นี้ด้วย  รบกวนแจ้ง Admin เพื่อแก้ไขต่อไป
ขอบคุณครับ

#WindowsForensic #ComputerForensics #dfir #forensics #digitalforensics #computerforensic #investigation #cybercrime #fraud