Forward the logs off the host before you need them

applied · 75 min · Objective 4.4

Task

Centralise logs from one VM to another, then clear the logs on the source the way an intruder would and show that the forwarded copy survived. Log centralisation is a security control, and this is the demonstration.

Steps

  1. On the Linux VM, configure rsyslog to forward to the second machine you built, and on that machine configure it to receive and write to a per-host file.
  2. Generate distinctive events on the source: several failed logins and a logger message containing a marker string.
  3. Confirm the events appear in BOTH places.
  4. Now do what an intruder does: on the source, truncate the auth log and the syslog — sudo truncate -s 0 /var/log/auth.log — and confirm locally that the evidence is gone.
  5. Check the collector. The same events are still there, because they left the host as they were written.
  6. Measure the window: generate an event, and time how long it takes to appear on the collector. That interval is how much evidence an attacker could still destroy, and write it into /tmp/logging.md.

Verify

grep -c "LABMARKER" /var/log/syslog || echo "0 locally (cleared)"
ssh 10.99.0.20 "grep -c LABMARKER /var/log/remote/10.99.0.10.log"
python3 - <<'PY'
import subprocess
local=subprocess.run("grep -c LABMARKER /var/log/syslog",shell=True,
                     capture_output=True,text=True).stdout.strip() or '0'
remote=subprocess.run(["ssh","10.99.0.20","grep -c LABMARKER /var/log/remote/10.99.0.10.log"],
                      capture_output=True,text=True).stdout.strip() or '0'
print('local copies: %s | forwarded copies: %s' % (local,remote))
assert int(local)==0, 'the local log was not actually cleared'
assert int(remote)>0, 'nothing was forwarded - the collector never received the events'
PY
grep -ciE "window|seconds|interval" /tmp/logging.md

Both assertions are required: the local evidence must genuinely be gone and the forwarded copy must genuinely be there. That pair is the entire argument for centralisation, and it is why anti-forensic log clearing is a standard step in intrusions and a mostly ineffective one against an estate that forwards.

Notes

The window you measured is the residual risk. Batching and buffering improve efficiency and widen it; the events written in the last few seconds before a compromise are the ones an attacker can still remove, and no amount of collector configuration closes that entirely.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.