Hello, everyone, and welcome back to the course. It ain't farm about extra logs, amigo. Vieira it in the last video, we talked about 82 b and T C P I p.
In this video, you start talking about Web. Several logs.
The learning objectives off this video are understands the importance off logs. Understand the website along information
Review Apache in Jack's in IIs, Log, Destructor
and perform initial organizes. This is, of course, about logs. But what? Our logs. Where Our Lord so important.
One of the definitions off log is a piece off foods.
This definition does not make sense to us,
you know. Of course, we use the second definition
that say that our log is a food reading record, often even
and the Web seven were being charged to generate this log.
Now we know the definition off a log with You need to know where the important
suppose you're a stock analyst
and you receive a call from the end user telling that the computer
If you do not have the logs, you need to go to the user computer and check it mentally,
and it can be too late.
Although If you have the logs, you can judge the user that everything is okay because it check it. The log in the log say's that phantom our remove it the malicious, softer And in some cases you can have the rebbe access log in charge of the user that he visited a malicious website
more logs. You have one for make sure you have. That's why the logs are so important.
Also, the logs will help you understand your infrastructure and applications
so I could want or it
it will also help you. He thinks like troubleshooting
loves are so important that you are stopped in project included. Black off logging as a vulnerability on 2017 version.
If you did not know where is a wasp, The worry. We'll talk about it later.
Plugs can help you a lot.
And if you work for bringing to work as a stock analyst, it is important to know what you need to protect
because you cannot protect what it do not know
sees the log is a record.
We need to start it.
There are two basic ways to do it.
loco. You save all the logs on the same place that was generated
and remote is used when you need to send the logs. Journal the place. Maybe because you can storage locally or you want another copy.
Remote logging is useful because you can have other logs in the same place. If you have many servers, it will help to have all the logs in the same place.
So let's start talking about Web application or seven logs.
Most off the time. We can split the information in some questions.
Who did the action when the action was performed and what was the action?
Mobile. The attacks will be detected here.
This is a really simple Web. Several log
we get easily they'd find a log. What happened
that we address in user name is the hope. Daring time is when,
and the request is the world.
Now, one more example.
It is important to know that empty fields aren't allowed, so it's not going to see a hyphen.
The hyphen means no information for that field.
Let's analyze our log. Example.
First we have the I P address.
The next few is related to our C 14 13
but this field is not really common on the logs.
It depends on Web several and Web application.
The next field is a user I G
follow by there in time.
Their entire informers depends on the configuration off the Web, several organs
the next few contains many information.
The GP method used by the client,
the requested fire by the client and the TTP version.
After we have the starts cold, this sizing bites off the answer. The refer and the user agent.
Just, you know, this was an Apache Web server. Log it simple.
Okay, now that I know the log fields, what can I do with them? We always need to answer the three questions
who went inwards in the log will help us.
Let's check one for Major. Each of you can tell us so saipi in user org would say who
they're in time When and other orders were explained. What happened
just to clarify here, the evil for each feud
lords are using it to rebuild the user behavior by actions
in this world would say to us they use it if I pee Tenn 0.3 dot 89.4 wasn't the Logan will be patient in access. Another Web page
in You Thought Jim L.
The uses scent again using Mozilla Firefox
in John Closer, this F B in and the Web. Seven. Yes, word without your 100. So no errors.
They are C 14 13 would say the user off their requests. It asking help identifying who did the action
and wait. It's use it if you looks like unusual idea information. But as we said before, it's hard to see a Web server using this yield.
take some time and then analyze these Web several loads
for us. We have the source I p address
after we have the dating sign,
followed by the user requests
You can see in this less line that almost all the log feuds are important and you'll be using for during the analysis
Now. Only thing missing is the answer to the questions. Who, when and what
Here we have the who
We only have information about the client. I p address
The date is the answer off. The win question
and all the information is the answer off. The what question
this is Live shows a resume off important log feuds and its description.
It is important to this thing. They love fields because it will help you analyze the Web server logs,
spend some time and take notes. If you want a good place to get more, information is on about your website.
There's a lesson continues on the next video.