312-50 Question 156
Single answer▪ Clearing LogsDuring an authorized internal penetration test of a Linux web server, you obtain root access and are asked to demonstrate anti-forensics techniques that an attacker might use after privilege escalation. The server uses systemd-journald and also stores traditional logs under /var/log. You need to show the security team the most direct command that clears the systemd journal entries from the current machine without simply rotating logs or restarting the service. Which command best meets this objective?
- A
journalctl --vacuum-time=1s
- B
systemctl restart systemd-journald
- C
echo "" > /var/log/messages
- D
history -c
Show answer and explanation
Correct answer: A
Explanation
This question focuses on distinguishing between clearing system logs and clearing artifacts unrelated to centralized logging. In Linux environments that use systemd-journald, logs are typically stored in a binary journal rather than only in plain-text files such as /var/log/messages or /var/log/secure. The journalctl utility is the appropriate administrative interface for inspecting and managing these logs. The vacuum options, documented in the journalctl man page, remove archived journal files based on age, size, or file count. Restarting journald does not delete log contents, and clearing shell history affects only user command recall, not host logging. In a real CEH context, candidates are expected to recognize attacker anti-forensics behavior, but also to understand that these actions are detectable and often limited by centralized logging, remote forwarding, immutable logging configurations, and SIEM retention policies. References: systemd and journalctl documentation, especially the journalctl manual covering --vacuum-time, --vacuum-size, and --vacuum-files.
- A. Correct.
Correct. On systems using systemd-journald, journalctl provides maintenance functions for the binary journal. The --vacuum-time option removes archived journal files older than the specified time. Using a very small threshold such as 1 second is a direct way to aggressively purge retained journal data for demonstration purposes. This targets the systemd journal itself rather than shell history or a single traditional text log.
- B. Incorrect.
Incorrect. Restarting systemd-journald does not clear existing journal entries. It may close and reopen journal files, but the stored log data remains unless explicitly removed or vacuumed. A common misconception is that restarting a logging service wipes its records, but that is not how journald normally behaves.
- C. Incorrect.
Incorrect. Redirecting an empty string into /var/log/messages truncates one traditional text log file, assuming that file exists and is used on that distribution. It does not clear the binary systemd journal, which is the key requirement in the scenario. Many modern Linux systems rely primarily on journald, and some do not actively use /var/log/messages at all.
- D. Incorrect.
Incorrect. history -c clears the current shell's command history in memory for that shell session. It does not affect system logs, audit records, journal entries, or logs generated by services. Candidates sometimes confuse shell history clearing with actual log clearing, but they are different anti-forensics activities.