# Linux Logging, Journaling, and Auditing

> Master Linux log management. Explore syslog, the systemd journal, and auditd to track attacker activity, detect intrusions, and investigate security incidents.

Canonical: https://codelivly.com/rooms/linux-logging-journaling-and-auditing
Last updated: 2026-07-04

| | |
|---|---|
| Level | Beginner |
| Category | Cybersecurity |
| Lessons | 3 |
| Estimated time | 30 min |
| XP | 200 |

Dive into the forensic backbone of Linux. The Linux Logging, Journaling, and Auditing module breaks down how the OS records every action, from basic system events to granular file access and system calls.

You will learn to navigate /var/log, master the journalctl command, and configure the powerful auditd daemon to track unauthorized privilege escalation and file modifications. By the end of this module, you will know how to hunt for attacker footprints, detect log tampering, and build a robust auditing framework to catch even the stealthiest intruders.

## Lessons

1. Rsyslog and the /var/log Landscape (30 min)
2. Systemd Journal & journalctl (30 min)
3. Auditd: The Ultimate Syscall Tracker (30 min)

## Related

- [Learning path: Linux Fundamentals for Cybersecurity](https://codelivly.com/learning-paths/linux-fundamentals-for-cybersecurity)
- [All rooms](https://codelivly.com/rooms)