Linux logs for SOC

This is not an exploit list. Practise reading your own lab before you ship every host into Wazuh.

Where the log lives

On most lab stations:

• journalctl -xe / -u ssh / -u sshd / --since today
• auth: Debian/Ubuntu often /var/log/auth.log; RHEL family — secure
• syslog / messages — other daemons, if rsyslog/syslog-ng writes at all
• kernel: dmesg or the journal

Examples I replay myself:

journalctl -u ssh --since today
grep -E "Failed|Accepted" /var/log/auth.log | tail
timedatectl

If timedatectl shows a different zone than Windows, SSH ↔ 4624 correlation lies. That is a more common lab bug than “no IDS”.

Fields without which a note is empty

timestamp (timezone), hostname, process, user, source address.

SSH: successful and failed logons live in auth. So does sudo. A Wazuh alert without those fields is a colour, not triage.

The SIEM agent (see Wazuh basics) collects the same journal/auth. Read the file on the host first, then look for it on the dashboard.