CSA (312-39) SOC Simulation Lab

Master operating system log locations to accelerate your incident response investigations. In this lab, you'll troubleshoot network traffic drops on a Linux server.

Scenario Context

You are a Tier 2 SOC Analyst responding to an escalation from the application team. The company's payment gateway application is unexpectedly dropping connections from a newly provisioned internal API server.

The network team has verified that there are no hardware firewall blocks. You suspect the local host-based firewall (iptables) on the Ubuntu 22.04 LTS payment gateway is dropping the traffic. You have SSH access to the machine and need to verify the raw iptables drop logs.

Security Environment

Hostname: ip-10-0-15-42.ec2.internal (Ubuntu 22.04 LTS)
SIEM Status: Log agent is currently experiencing a queue delay of ~15 minutes. You must investigate locally via SSH.

user@ip-10-0-15-42:~$ sudo iptables -L INPUT -n -v | grep LOG
14 840 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix "IPTABLES-DROP: "
user@ip-10-0-15-42:~$ _

The rule is clearly configured to log dropped packets using the kernel's logging facility.

Question

Which of the following command is used to view iptables logs on Ubuntu and Debian distributions?

SOC Hint: Think about Linux distributions. Red Hat/CentOS typically uses messages, while Debian/Ubuntu splits OS logging. Since iptables runs at the kernel level, where would Debian route kernel-level facility logs?

Expert Insight: Senior SOC Analyst Mentorship

What is happening:
You're responding to a localized traffic drop. Because the SIEM log shipper is delayed, you need to query the OS directly. Netfilter/iptables operates in the kernel space. When you use the -j LOG target in iptables, it sends log events to the kernel logging daemon (klogd or integrated into systemd-journald/rsyslog).

Why B is correct:
On Debian and Ubuntu distributions, the default rsyslog configuration routes kernel facility messages (which includes iptables logs) directly to /var/log/kern.log. Using tailf (or the more modern tail -f) on this file allows you to watch dropped packets in real-time.

Why the others are wrong:

Option C (/var/log/messages): This is the default log file for Red Hat Enterprise Linux (RHEL), CentOS, and Fedora distributions. While Ubuntu has syslog, kernel messages are specifically separated out to kern.log.
Options A & D (/var/log/sys/...): These are completely fabricated directory paths. The /var/log/sys/ directory does not exist by default in any standard Linux distribution.

SOC Mini-Lesson: Syslog Facilities

In the SOC, you can't always rely on an EDR or SIEM parsing data perfectly for you. You need to understand how the OS generates data. Linux uses facilities and severities to route logs.

auth/authpriv: Used for SSH, sudo, and login attempts (routed to /var/log/auth.log or secure).
kern: Used for hardware, drivers, and iptables (routed to /var/log/kern.log).
daemon: Background services without their own log files.

Pro Tip: On modern Ubuntu systems running systemd, you can also view these live using: journalctl -k -f (where -k means kernel ring buffer, and -f means follow).

Ready to validate your skills further?
Explore more CSA simulations by ExamRange →