Live Linux Forensics training coming up @WWHackinFest Deadwood! Let's do some daily Linux Forensics trivia as a lead-up! wildwesthackinfest.com/deadw…
34
50
2
95
Daily Linux Forensics Trivia #32 - You find entries in an Apache web server log whose timestamps are out of chronological order. Does this mean the log has been tampered with?

Oct 7, 2022 · 1:45 PM UTC

3
2
Trivia Answer #32 - It is actually not uncommon to find Apache log entries out of chronological order. The log timestamps show the time the web request was received, but the log entries are not written until the web response is completed.
1
1
3
This means that web requests that take longer than usual to be fulfilled may be logged later than shorter duration requests that were actually received after the slow web request. Shout outs to @DfirNotes and @mboelen on this one!
1
Replying to @hal_pomeranz
without rtfm I'm guessing the logs are written when a connection / request ends and since requests can be different size and vary in processing time they could easily be out of order from our perspective?
Replying to @hal_pomeranz
I would guess that this is caused by different workers