LogGUI

the executable file within the file explorer. The second way is to run ./LogGui in the terminal within the project directory. 

4.MOTIVATIONS AND OBJECTIVES

The auth log is difficult to fully read and understand by hand. Even though it is in plain text format, it can contain thousands of lines of events. Many of these lines can occur within the same minute. It can be difficult to monitor the authorization events of a system just by looking at the auth log. The goal of our project was to make a visualization of the auth log to increase the likelihood that suspicious activity is noticed.  We decided to make several visualizations and text windows to summarize the auth log. These visualizations include authorization events and login attempts. The text windows include sudo command calls, users, groups, and flagged events. 

5.METHODOLOGY

In order to ease the process of reading log files, and to ensure that administrators have easy access to the important information, we identified various types of log file entries to monitor. The metrics we chose are: Authorization events such as signing in as a different user, attempting to use sudo, or changing a users password, login events and whether they were successful, as well as implementing a system that detects if flags events based on criteria that makes the action appear suspicious, such as the action taking place outside of normal business operating hours. We feel that these metrics offer system administrators an easier alternative to finding logs that may interest them as opposed to manually combing through the log file searching for suspicious activity. Additionally, we provide several visuals to allow the user to more easily interpret the information presented. As the purpose of this project is to simplify log analysis, we wanted a simple design to reflect this. We divided each main metric into separate tabs, as shown in the mockup below (Figure 1)

6. WINDOWS

6.1 Sudo Commands

Maintaining a robust audit trail of system activity is essential for security purposes. LogGui fulfills this role by specifically focusing on sudo command executions. To do this we parse through the /var/log/auth.log. It serves as a centralized log, and records each instance of a user employing the sudo command. This includes details like the user who executed the command, the specific command itself, and the timestamp of the action. By analyzing the data, administrators can gain valuable insights into system activity, identify potential security risks, and ensure authorized use of administrative privileges.

6.4 Authorization Events

While interacting with a linux system, there are many occasions where the system will prompt the user to enter a password to proceed with the action the user is attempting. Regardless of the success of the action, the user, the action, and the result are stored in a log file with a timestamp detailing when the action took place. Using these logs, a system administrator can determine whether someone was attempting to use commands they are not meant to, however the process of reading the log file can be tedious to perform by hand. The authorization events window eases the burden placed on the administrator by filtering the log file and printing the entries that correspond to commands that might interest the administrator, such as sudo, su, and passwd, and produces a histogram showing when the authorization events are taking place , shown in Figure 5. 

visual representation through graphical bars of the proportion of successful logins versus failed logins. At the bottom of the window, it also displays a list of all users on the system that have three or more failed login attempts. This window works by reading each line of the auth.log while looking for keywords that indicate a successful or a failed SSH login attempt. Once a successful login attempt is found, the necessary variables and data structures are updated. The purpose of this window is to help system administrators assess the integrity of their system and gather important usage data. By viewing successful logins, system administrators can see how many users have received access to the system, which is important knowledge to determine how many users your system must be able to handle. While the successful login metric is more useful for determining capacity and usage data, the failed login metric is probably more useful from a security standpoint. Repeated failed login attempts or a high proportion of failed logins could indicate that a bad actor is trying to gain access to your system. With the failed login count, a system administrator can monitor failed logins and look into any suspicious behavior when the count suddenly gets much higher. Additionally, the list of users who have failed to log in three or more times can notify the system administrator of what user someone is attempting to break into. The system admin could use this list of users to lock certain accounts so that they cannot SSH into the system. Or, in the case of an innocent user who cannot figure out their password, the system admin could reach out to that user to help them figure out or reset their password.