Are Logs created by kernel?

SecNoob · 07-04-2018, 11:49 PM

I was reading through 'The Cuckoos Egg: Tracking a spy through the maze of computer espionage' by Stoll,C. in which a hacker deleted logs after going through the files of a compromised system. It got me wondering whether a master log is created by the kernel which records all activities including creation and deletion of the logs which we can access.

pan64 · 07-05-2018, 01:26 AM

there is no such thing (master log). And also there is no log of "all activities" because this expression is not really [well] defined. There can be remote logging which may or may not be known/available for that intruder.
A missing/manipulated log file itself is a clear sign of "something strange", so hard to make a complete cleanup.