Topic: which logs to show access

[mcp_dk]

Apparently My SME Server has been compromised. IT may have happened through an unpatched CMS or other. However the authorities would like if i could provide them with some logs about who and when users have been authenticated and logged on.

So Which logs should i look in to if i want to see which users have been logged on the server and when?
Also other logs that could be usefull to look into!?

[gzartman]

For a webapp, the best log file is likely:

/var/log/httpd/access_log

Greg