What is log clearing?¶
The practical answer¶
Log clearing is the deletion, truncation or reset of recorded system, application or security events.
The key evidential caution¶
The dangerous assumption is that a cleared log proves the person who cleared it committed the underlying incident.
It does not.
Logs may be cleared during:
Key points¶
- maintenance
- testing
- storage management
- software reinstall
- troubleshooting
- incident response
- system rebuild
An offender may clear logs to conceal access, commands, account use or persistence.
Evidence to preserve¶
Investigators should preserve:
Key points¶
- the log-clear event
- account and process responsible
- command or tool used
- time
- affected log source
- records immediately before and after
- central or forwarded copies
- provider or security-platform records
A local log may be cleared while copies remain in a SIEM, cloud service, backup or management platform.
Evidential limits¶
Do not assume the clear event removed every relevant record.
Likewise, a gap in a log does not prove manual clearing if the service stopped, storage filled or retention rolled over.
Compare system time, service state, log size and collection health.
The timing matters.
A clear event immediately after suspicious activity may support concealment.
A routine clear during scheduled maintenance may not.
Central collection can also preserve evidence of the clearing action even where the local content is gone. Check whether the system forwarded events before the clear, whether collection stopped at the same time and whether the affected account accessed logging or security settings immediately beforehand.
Operational takeaway¶
Establish who or what cleared the log, which records were affected and what copies survive, and keep concealment separate from attribution for the wider incident.