linux:syslog

syslog / journald (auth, secure, messages, cron)

Licensing

License or service: systemd-journald / rsyslog
What is free: In distro
What costs: Nothing
Notes: UNCONFIRMED (man page not opened)
Vendor page: https://www.freedesktop.org/software/systemd/man/journald.conf.html
As read on: 2026-11-01

A vendor statement as read on the date shown; the cost class is the durable part.

Requirement	Relation	Basis
OMB M-26-14: Identity used	Supports an activity	our analysis: sshd and sudo records name the account
OMB M-26-14: Privilege changes	Supports an activity	our analysis: sudo and su records
OMB M-26-14: Attack vectors and lateral movement	Supports an activity	our analysis: sshd records
ASD ACSC / CISA et al.: Priority enterprise log sources	priority_source	quoted: internet-facing services and their underlying server operating system

Splunk 5

Sigma 11

Disabling Security Tools - Builtin by Ömer Günal, Alejandro Ortuno, oscd.community
Guacamole Two Users Sharing Session Anomaly by Florian Roth (Nextron Systems)
Modifying Crontab by Pawel Mazur
Potential CVE-2023-2283 Exploitation by Florian Roth (Nextron Systems)
PwnKit Local Privilege Escalation by Sreeman
Relevant ClamAV Message by Florian Roth (Nextron Systems)
SSHD Error Message CVE-2018-15473 by Florian Roth (Nextron Systems)
Sudo Privilege Escalation CVE-2019-14287 - Builtin by Florian Roth (Nextron Systems)
Suspicious Named Error by Florian Roth (Nextron Systems)
Suspicious OpenSSH Daemon Error by Florian Roth (Nextron Systems)
Suspicious VSFTPD Error Messages by Florian Roth (Nextron Systems)

Elastic 18

Microsoft Sentinel 176