Cloud Server Log Auditing and Operation Tracking: Who Did What and When?

Last year, a client's server was compromised. It took them three days to figure out how the attacker got in and what they did. Not because the attack was sophisticated — because the logs were scattered across servers, some had been deleted, some were never enabled. "If I could have traced who did what and when earlier, this wouldn't have dragged on so long," they told me.

The value of log auditing is invisible until you need it. When you do, it's the only thing that tells you the truth.

The core insight: Log auditing isn't just about compliance. It's about being able to answer "what actually happened" after the fact.

01 What Does Log Auditing Actually Track?

MLPS 2.0 (China's Classified Protection of Cybersecurity) has clear requirements for log auditing: the audit scope must cover every OS and database user; records must include date, time, user, event type, and outcome; and logs must be retained for at least 180 days . But compliance is the floor, not the ceiling. Real log auditing does three things: complete recording, traceability, and searchability.

Complete recording: Who (user/process), when (to the second), from where (login IP), what was done (command or operation), and what happened (success/failure).

Traceability: When an incident occurs, you can follow the log trail to reconstruct the attack path — how long they were inside, what they touched, what they took. Without a complete log chain, forensics is guesswork.

Searchability: Logs aren't just stored. During an incident, you need to find specific operations within minutes, not scroll through hundreds of log files one by one.

02 Where Do Logs Come From?

System logs (auth.log / secure): Record login attempts — who logged in from which IP, success or failure, sudo privilege escalations. This is the first stop in any investigation. Every failed login attempt from an attacker is recorded here.

auditd audit logs: Linux's kernel-level audit framework. It monitors critical file changes, privileged command execution, and system calls. For example, who modified /etc/passwd, who read /etc/shadow — events that ordinary system logs don't capture . After configuration, you can use ausearch and aureport for queries and statistical reports.

Cloud provider operation audit (AWS CloudTrail / Alibaba Cloud ActionTrail): Records all operations on cloud resources through the console, API, and SDK. Who created a server, who deleted a security group, who changed a storage bucket policy — these don't appear in server logs, but they're all in operation audit trails. The default retention is 90 days, and logs can be delivered to log services for long-term storage .

03 Centralised Log Management: Distributed Logs Are as Good as No Logs

Logs scattered across servers are impossible to search during an incident. Attackers may also delete local logs. Centralised log management is the foundation of forensics.

Option 1: Cloud provider log services (Alibaba Cloud SLS, Tencent Cloud CLS, Huawei Cloud LTS): Server logs are delivered in real time to a central platform, supporting fast search, alerting, visualisation, and long-term retention. Meets the 180-day MLPS retention requirement .

Option 2: Self‑hosted ELK: Elasticsearch + Logstash + Kibana. Flexible, open-source, but requires maintenance. Suitable for teams with ops capacity.

04 A Real Example

A company suspected an internal employee of leaking data. Server logs only showed login records, not operations. They enabled auditd to monitor /etc/passwd changes, access and modifications to critical business data, and privilege command execution. Two weeks later, anomalous behaviour was captured — an operations engineer executed a data export command via sudo at 3 AM. The logs recorded the user, timestamp, and exact command. The evidence was conclusive.

The Bottom Line

Having logs doesn't guarantee auditability, but without logs there's no trace. The client rebuilt their log auditing system: system logs delivered in real time to SLS, auditd monitoring critical files, and cloud operation auditing enabled. "We used to guess. Now we can investigate," they said.

That's the purpose of log auditing — not to keep attackers out, but to reconstruct the full story when they get in.