Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Background:

i am running a Dedicated Server with WHM/cPanel and i would like to know what to backup. My old VPS was hacked into using a security vulnerability in TimThumb and i was unable to track back who had done it because the logs were being deleted once in a while and some time had passed before i could analyze it, the logs were gone.

On my new (and hopefully secure:) server i would like to regularly backup logs and everything i should need to track down someone who executed malicious commands and web request on my server.

Question:

  • What do i need to backup to track stuff like http events, SSH connections & etc?
  • Where exactly are those files located?
  • Is there an automated way of copying the files or doing this backup?

Please advise me on this task.

Thank you

share|improve this question

1 Answer 1

For the httpd service Apache, you can backup the log files, typically found in /var/log/httpd or /var/log/apache.

For SSH logins you can check the log files: /var/log/auth(.log), /var/log/secure(.log) and you can dump the command last to a "log" file for backing up as well by doing last > /var/log/ssh_logins.

You can automate backing up these files via cron and a custom backup script, or using something like rsync or dervish

share|improve this answer
    
Or better yet, use syslog-ng or rsyslog to push them immediately to a different server. You can also change how long logs are kept for, how often they are rotated and when and whether they are compressed by editing the files in /etc/logroatate.d/. –  Ladadadada Jan 26 '12 at 16:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.