Log Analysis

Haripriya A — Thu, 15 Sep 2022 05:55:22 +0000

1. Write down top 10 events in Windows and identify their event ID

4723 - An attempt was made to change the password of an account
4625 - Failed account login
4624 - Successful account login
4719 - System audit policy was changed.
4722 - A user account was enabled
4634 - account logged off
4648- A logon attempt was made with explicit credentials
4964 - Special group has been assigned to a new log
1102 - Audit log was cleared.
4720 - A user account was created

2. Write down top 10 events in Linux and identify their pattern and log Linux
/var/log/messages
/var/log/auth.log
/var/log/cron
/var/log/yum.log
/var/log/maillog
/var/log/secure
/var/log/boot.log
/var/log/dmesg
/var/log/kern.log
/var/log/faillog
**

Identify the log file in linux which log service start|stop|enable|disable** systemctl start SERVICE_NAME systemctl stop SERVICE_NAME systemctl enable SERVICE_NAME systemctl disable SERVICE_NAME

4. Identify the log file in linux which log process running or killed.

      check the logfile using this - /var/log/kern.log

5. Identify the log file of apache and find out list of VERB and count of each using linux command
var/log/apache/access.log
/var/log/apache2/access.log
/etc/httpd/log/access_log (on MacOS)
/var/log/apache2/error.log

Understanding Datadog Agent

Haripriya A — Tue, 13 Sep 2022 10:00:00 +0000

- What is Datadog agent? Datadog is a software that runs on your host. It collects hosts metrics and event and send it to Datadog. In Datadog u can analyse your monitoring and performance data.
*- Type of Datadog Agent? * Collector
Dogstatsd

- Ports used to in Datadog agent? UDP , HTTP - 80, TCP, HTTPS - 443

- Top 5 commands with simple explanation troubleshooting Datadog agent? $ systemctl start datadog-agent - to start the datadog agent
$ systemctl stop datadog-agent - to stop the datadog agent
$ systemctl restart datadog-agent- to Restart the datadog agent
$ systemctl status datadog-agent- to status is running or not in the datadog agent
$ datadog-agent version - to find the version

- Locate how to enable Logs monitoring in datadog.yaml ** Go to the datadog file located in the windows c:/ programdata/datadog.yaml
Edit the file and add enable the option to true.
**- 5 techniques for troubleshooting Datadog?
Verify API token (datadog.yaml)
Verify site/region (datadog.yaml)
Datadog Agent is running or not under services
check if logs enabled under config file

Debug School: Haripriya A

Log Analysis

Understanding Datadog Agent