Log Analysis

Sourav Karmakar — Thu, 15 Sep 2022 06:15:00 +0000

1. Write down top 10 events in Windows and identify their event ID

event ID - 4624 /25 - successful and failed account log on , 4648 - system logon attempt with explicit credentials, 4719 -system audit policy changed, 1102 - audit logs cleared, 4723 - attempt made to change the password of account, 4740 - user account locked, 4735- priviledge local group modified, 4782 - password has an account was accessed, 4946- rule was added to windows firewall exception list.

2. Write down top 10 events in Linux and identify their pattern and log linux

/var/log/messages
/var/log/auth.log
/var/log/secure
/var/log/boot.log
/var/log/dmesg
/var/log/kern.log
/var/log/faillog
/var/log/yum.log
var/log/httpd/
/var/log/mysql.log

3. Identify the log file in linux which log service

start|stop|enable|disable
start - sudo systemctl start service.service, stop- sudo systemctl stop service.service, enable - sudo systemctl enable name_service.service,
disable - sudo systemctl disable name_service.service

4. Identify the log file in linux which log process running or killed.

/var/log/kern. log

5. Identify the log file of apache and find out list of VERB and count of each using linux command

Location of the Log Files By default on Debian-based distributions such as Ubuntu, access and error logs are located in the /var/log/apache2 directory. On CentOS the log files are placed in /var/log/httpd directory. Reading and Understanding the Apache Log Files

Understanding Datadog Agent

Sourav Karmakar — Tue, 13 Sep 2022 10:07:14 +0000

What is Datadog Agent?
The Datadog Agent is software that runs on our hosts. It collects events and metrics from hosts and sends them to Datadog, where we can analyze our monitoring and performance data.

Types of Datadog Agent.
Collector, DogstatsD

Ports used to in Datadog Agent
443/tcp, 123/udp

Top 5 commands
$ systemctl start datadog-agent - start the agent
$ systemctl stop datadog-agent - stop the agent
$ systemctl status datadog-agent - status of the agent
$ datadog-agent config - print all the runtime configuration
$ more /etc/datadog-agent/datadog.yaml - details of configuartion file
$ ls /var/log/datadog/ - listing

Locate how to enable Logs monitoring in datadog.yaml
edit the datadog-values.yaml file. Locate the logs: section and set enabled: false to enabled: true.

Techniques for troubleshooting Datadog
Verify API token (datadog.yaml)
Verify site/region (datadog.yaml)
Restart the services
check if logs enabled under config file

Debug School: Sourav Karmakar

Log Analysis

Understanding Datadog Agent