Nancy, a security specialist, was instructed to identify issues related to unexpected shutdown and restarts on a Linux machine. To identify the incident cause, Nancy navigated to a directory on the Linux system and accessed a log file to troubleshoot problems related to improper shutdowns and unplanned restarts.
Identify the Linux log file accessed by Nancy in the above scenario.
The /var/log/boot.log file is a system log that records all messages generated during the Linux boot process. It captures service startup events, initialization output, and any errors that occur as the operating system loads — making it the primary source for diagnosing shutdown and restart issues.
When a Linux system starts up, the init system (such as systemd or SysVinit) writes boot-time output to /var/log/boot.log. Each service that starts or fails during boot is logged here. After an unplanned restart, this file reveals whether services crashed, timed out, or encountered errors during the previous shutdown or subsequent reboot sequence.
For security specialists like Nancy, unexpected shutdowns can indicate hardware failures, kernel panics, malicious activity, or misconfigured services. The boot log provides a chronological record of what happened at startup, enabling analysts to trace the root cause of unplanned restarts and determine if the event was accidental or an attack.
Imagine a production server rebooting every night at 2 AM. By reviewing /var/log/boot.log, an analyst discovers that a faulty cron job triggers an out-of-memory condition, causing the OOM killer to terminate critical processes — leading to a system reboot. The boot log timestamps correlate with the restart pattern, confirming the root cause.
Different logs serve different purposes: /var/log/secure tracks authentication, /var/log/kern.log records kernel messages, and /var/log/lighttpd/ is for the Lighttpd web server. When investigating improper shutdowns and unplanned restarts, /var/log/boot.log is the go-to log file — remember this for the CCT exam.