Which of the following directories should be checked for system log files when a Linux system has been compromised?Select one:a./varb./etcc./bind./usr

When investigating a compromised Linux system, the primary directory to check for system log files is /var. This directory contains various logs that are essential for monitoring system activity and identifying potential security issues.

1. Understanding the Directory Structure:

   • /var: This directory typically includes log files located in /var/log, which are crucial for troubleshooting and security analysis.
   • /etc: This directory contains configuration files, not log files.
   • /bin: This directory holds executable binaries, which are not related to logs.
   • /usr: This directory contains user programs and may include some logs, but they are not the primary source for system logs.

2. Relevant Log Files: Common log files found in /var/log include:

   • syslog: Contains system activity logs.
   • auth.log: Records authentication-related events, which can be critical for understanding unauthorized access.

In summary, the correct answer is:

Final Answer

a. /var