Read Your Own System Logs

What are logs, and why should I care?

Every time something happens on your computer—a login, a crash, or a network connection—it leaves a trace. This trace is a log entry: a timestamped line of text telling you that something happened at a specific time.

Logs are a blue team's best friend. When an attacker breaks in, they leave evidence behind. Logs are how defenders find that evidence and figure out what happened.

Where do logs live?


macOS

Logs live in /var/log/. The main one is system.log.

Linux

Your logs live in /var/log/. The main ones are syslog and auth.log.

Windows

Windows uses Event Viewer instead of text files. Press Windows + R, type eventvwr, and press Enter.

See who logged in

One of the first things a defender checks: who accessed this machine?

macOS 
last
  • last — displays login history from /var/log/wtmp

Example output:

output 
username  console   Mon Jul  6 09:23   still logged in
username  console   Sun Jul  5 18:45 - 22:30  (03:45)
reboot    ~         Sun Jul  5 18:44

What each column means:

  • username — who logged in
  • console — where they logged in from (console means physically at the machine; ttys001 means a terminal window; pts/0 means remote)
  • Mon Jul 6 09:23 — when the session started
  • still logged in or - 22:30 — when it ended
  • (03:45) — session duration

If you see a login at 3 AM from an IP you don't recognize, that's worth investigating.

Linux 
last
  • last — displays login history from /var/log/wtmp

Example output:

output 
username  pts/0     192.168.1.5    Mon Jul  6 09:23   still logged in
username  tty1       :0             Sun Jul  5 18:45 - 22:30  (03:45)
reboot    system boot               Sun Jul  5 18:44

What each column means:

  • username — who logged in
  • pts/0 — which terminal (remote sessions show an IP here)
  • 192.168.1.5 — the IP address they connected from
  • Mon Jul 6 09:23 — when the session started
  • still logged in or - 22:30 — when it ended
  • (03:45) — session duration

In Event Viewer, expand Windows Logs in the left sidebar, then click Security. Look for event ID 4624 (successful login) and event ID 4625 (failed login).

What to look for:

  • Event ID 4624 — someone logged in successfully
  • Event ID 4625 — someone tried and failed
  • Multiple 4625 events in a row from the same IP is a brute-force attempt

Find Failed Logins

macOS 
cat /var/log/system.log | grep "Failed" | tail -20

What each part does:

  • cat — reads the file and outputs its contents
  • /var/log/system.log — the main system log on macOS
  • grep "Failed" — filters lines containing the word "Failed"
  • tail -20 — shows only the last 20 matching lines
Linux 
cat /var/log/auth.log | grep "Failed" | tail -20

What each part does:

  • cat — reads the file
  • /var/log/auth.log — authentication log on Linux (logins, sudo, SSH attempts)
  • | grep "Failed" — filters for failed attempts
  • tail -20 — last 20 lines

Example output:

output 
Jul  6 14:23:15 server sshd[1234]: Failed password for root from 45.67.89.10 port 22
Jul  6 14:23:16 server sshd[1234]: Failed password for root from 45.67.89.10 port 22
Jul  6 14:23:17 server sshd[1234]: Failed password for root from 45.67.89.10 port 22
Jul  6 14:23:18 server sshd[1234]: Failed password for root from 45.67.89.10 port 22

What this tells you: Someone at IP 45.67.89.10 is trying to guess the root password over SSH. Four attempts in four seconds. That's not a typo.


In Event Viewer → Windows Logs → Security, click Filter Current Log in the right sidebar. Type 4625 in the event ID field and click OK.

Each 4625 event shows:

  • The account name they tried
  • The source IP address
  • The time of the attempt

Multiple 4625 events from the same IP = someone is trying to break in.

Look for Errors and Crashes

Not everything in logs is an attack. Sometimes applications crash or services fail to start. Defenders look at these too — a crashing security tool is a vulnerability.

macOS 
cat /var/log/system.log | grep -i "error" | tail -10
Linux 
cat /var/log/syslog | grep -i "error" | tail -10

In Event Viewer → Windows Logs → System, look for entries with Level: Error or Critical. These are marked with a red exclamation mark. Click any entry to see the details below.

Track Network Connections Your Machine Made

macOS 
cat /var/log/system.log | grep -i "network" | tail -10

You can also see live network connections right now:

macOS 
lsof -i -P -n
Linux 
cat /var/log/syslog | grep -i "network" | tail -10

For live connections:

Linux 
ss -tunap

In Event Viewer → Windows Logs → Security, look for event ID 5156 (network connection allowed by Windows Filtering Platform). Each entry shows source IP, destination IP, and port.

Follow a Log in Real Time

So far you've been reading old logs. But you can also watch logs live as events happen. This is how SOC analysts monitor systems — a live feed of everything occurring right now.

macOS 
tail -f /var/log/system.log
  • tail -f — "follow" mode. Instead of showing the last 10 lines and exiting, it stays open and prints new lines as they're written to the file

Open a second terminal and run a command. You'll see the log entry appear in the first terminal in real time. Press Ctrl + C to stop.

Linux 
tail -f /var/log/auth.log

Open another terminal and try to SSH into your own machine with a wrong password. Watch the failed attempt appear instantly in the first terminal. This is what defenders see during an attack.


Event Viewer updates in real time automatically. Click Refresh in the right sidebar or press F5 to see the latest events. You can also right-click a log and select Clear Log to start fresh and watch new events come in.

How Attackers Try to Cover Their Tracks

If an attacker gets into a system, they'll try to delete the logs that show them breaking in. Commands like these exist:

bash (do not run) 
echo "" > /var/log/auth.log
history -c

The first command empties the auth log. The second clears the shell history so you can't see what commands they ran. This is why defenders send logs to a remote server in real time — so attackers can't delete the evidence.