ITM is an open framework - Submit your contributions now.

Insider Threat Matrix™Insider Threat Matrix™
  • ID: AF002.002
  • Created: 25th May 2024
  • Updated: 04th August 2025
  • Platform: Linux
  • Contributor: The ITM Team

Clear Linux System Logs

A subject deletes Linux system logs to obscure or eliminate evidence of an infringement. Linux log files, such as authentication attempts, sudo usage, system errors, and audit trails, serve as critical forensic artifacts during post-incident analysis. These logs are commonly stored in /var/log, and include files such as auth.log, syslog, messages, and secure.

 

Deletion may occur manually via the rm command, through scripted automation, or by modifying log rotation settings to erase historical activity.