tail -f<\/code>, grep<\/code>, less<\/code> gibi araçlar\u0131 birli\u015ftirip sürekli terminal de\u011fi\u015ftirmek yorucu de\u011fil mi? lnav (Log File Navigator)<\/strong> tam bu sorunu çözmek için tasarlanm\u0131\u015f devrimsel bir araçt\u0131r.<\/p>\r\n\ud83c\udfaf lnav Nedir?<\/h2>\r\n
lnav, log dosyalar\u0131n\u0131 analiz etmek için özel olarak tasarlanm\u0131\u015f geli\u015fmi\u015f bir terminal uygulamas\u0131d\u0131r. Apache, Nginx, systemd journal, Docker, PostgreSQL ve yüzlerce farkl\u0131 log format\u0131n\u0131 otomatik olarak alg\u0131layarak tek bir arayüzde birle\u015ftirir.<\/p>\r\n
Temel Avantajlar:<\/h3>\r\n\r\n- Çoklu format deste\u011fi:<\/strong> 100+ log format\u0131n\u0131 otomatik alg\u0131lar<\/li>\r\n
- Gerçek zamanl\u0131 izleme:<\/strong> Dosyalar de\u011fi\u015ftikçe otomatik güncellenir<\/li>\r\n
- SQL sorgular\u0131:<\/strong> Log verilerini SQL ile sorgulayabilirsiniz<\/li>\r\n
- Zaman senkronizasyonu:<\/strong> Farkl\u0131 kaynaklardan gelen loglar\u0131 zaman damgas\u0131na göre birle\u015ftirir<\/li>\r\n
- Görsel arayüz:<\/strong> Renkli syntax highlighting ve histogram görünümü<\/li>\r\n<\/ul>\r\n
\ud83d\udcbe Kurulum<\/h2>\r\nLinux (Debian\/Ubuntu):<\/h3>\r\n# APT ile kurulum\r\nsudo apt-get update\r\nsudo apt-get install lnav\r\n\r\n# Snap ile kurulum\r\nsudo snap install lnav<\/code><\/pre>\r\n\r\n<\/code><\/pre>\r\nLinux (Red Hat\/CentOS\/Fedora):<\/h3>\r\n# DNF ile kurulum (Fedora)\r\nsudo dnf install lnav\r\n\r\n# YUM ile kurulum (CentOS\/RHEL)\r\nsudo yum install lnav\r\n# EPEL repository gerekli olabilir\r\nsudo yum install epel-release<\/code><\/pre>\r\nmacOS:<\/h3>\r\n# Homebrew ile kurulum (önerilen)\r\nbrew install lnav\r\n\r\n# MacPorts ile kurulum\r\nsudo port install lnav<\/code><\/pre>\r\nWindows:<\/h3>\r\n# Scoop ile kurulum\r\nscoop install lnav\r\n\r\n# Chocolatey ile kurulum\r\nchoco install lnav\r\n\r\n# WSL içinde Linux kurulum komutlar\u0131 kullan\u0131labilir<\/code><\/pre>\r\n\r\n<\/code><\/pre>\r\nKaynak Koddan Kurulum:<\/h3>\r\n# Gerekli ba\u011f\u0131ml\u0131l\u0131klar\r\nsudo apt-get install build-essential libncurses5-dev libreadline-dev zlib1g-dev libbz2-dev libsqlite3-dev libcurl4-openssl-dev\r\n\r\n# Kaynak kodunu indirme ve derleme\r\nwget https:\/\/github.com\/tstack\/lnav\/releases\/download\/v0.11.2\/lnav-0.11.2.tar.gz\r\ntar xzf lnav-0.11.2.tar.gz\r\ncd lnav-0.11.2\r\n.\/configure\r\nmake\r\nsudo make install<\/code><\/pre>\r\n\ud83d\ude80 Temel Kullan\u0131m<\/h2>\r\nH\u0131zl\u0131 Ba\u015flang\u0131ç<\/h3>\r\n# Tek dosya açma\r\nlnav \/var\/log\/syslog\r\n\r\n# Birden fazla dosya açma\r\nlnav \/var\/log\/nginx\/access.log \/var\/log\/nginx\/error.log\r\n\r\n# Dizindeki tüm loglar\u0131 açma\r\nlnav \/var\/log\/\r\n\r\n# Compressed loglar\u0131 da dahil etme\r\nlnav \/var\/log\/*.log \/var\/log\/*.gz<\/code><\/pre>\r\nGerçek Zamanl\u0131 \u0130zleme<\/h3>\r\n# Watch mode ile ba\u015flatma\r\nlnav -t \/var\/log\/syslog\r\n\r\n# Tail mode (yeni sat\u0131rlar\u0131 takip et)\r\nlnav -f \/var\/log\/apache2\/access.log\r\n\r\n# Recursive mode (alt dizinleri de tara)\r\nlnav -r \/var\/log\/<\/code><\/pre>\r\n\ud83c\udfae \u0130nteraktif Komutlar ve Klavye K\u0131sayollar\u0131<\/h2>\r\nNavigasyon K\u0131sayollar\u0131<\/h3>\r\n
\r\n\r\n\r\nK\u0131sayol<\/th>\r\n Aç\u0131klama<\/th>\r\n<\/tr>\r\n<\/thead>\r\n \r\n\r\nSpace\/b<\/td>\r\n Sayfa a\u015fa\u011f\u0131\/yukar\u0131<\/td>\r\n<\/tr>\r\n \r\n↑\/↓<\/td>\r\n Sat\u0131r a\u015fa\u011f\u0131\/yukar\u0131<\/td>\r\n<\/tr>\r\n \r\nHome\/End<\/td>\r\n Dosya ba\u015f\u0131\/sonu<\/td>\r\n<\/tr>\r\n \r\ng\/G<\/td>\r\n Belirli sat\u0131ra git \/ Son sat\u0131ra git<\/td>\r\n<\/tr>\r\n \r\nn\/N<\/td>\r\n Sonraki\/önceki arama sonucu<\/td>\r\n<\/tr>\r\n \r\n\/<\/td>\r\n Arama modunu aç<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\nZaman Navigasyonu<\/h3>\r\n
\r\n\r\n\r\nK\u0131sayol<\/th>\r\n Aç\u0131klama<\/th>\r\n<\/tr>\r\n<\/thead>\r\n \r\n\r\nt<\/td>\r\n Zaman damgas\u0131 görünümünü aç\/kapat<\/td>\r\n<\/tr>\r\n \r\nT<\/td>\r\n Belirli zamana git<\/td>\r\n<\/tr>\r\n \r\nd\/D<\/td>\r\n Bir gün ileri\/geri<\/td>\r\n<\/tr>\r\n \r\nh\/H<\/td>\r\n Bir saat ileri\/geri<\/td>\r\n<\/tr>\r\n \r\nm\/M<\/td>\r\n Bir dakika ileri\/geri<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\nFiltreleme ve Görünüm<\/h3>\r\n
\r\n\r\n\r\nK\u0131sayol<\/th>\r\n Aç\u0131klama<\/th>\r\n<\/tr>\r\n<\/thead>\r\n \r\n\r\nf<\/td>\r\n Filtre menüsünü aç<\/td>\r\n<\/tr>\r\n \r\nF<\/td>\r\n Tüm filtreleri temizle<\/td>\r\n<\/tr>\r\n \r\ns<\/td>\r\n Histogram görünümünü aç\/kapat<\/td>\r\n<\/tr>\r\n \r\nx<\/td>\r\n Log level görünümü<\/td>\r\n<\/tr>\r\n \r\nX<\/td>\r\n Geni\u015fletilmi\u015f görünüm<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n\ud83d\udd0d SQL Sorgular\u0131 ile Log Analizi<\/h2>\r\n
lnav'\u0131n en güçlü özelliklerinden biri, log verilerini SQL ile sorgulayabilmesidir.<\/p>\r\n
Temel SQL Komutlar\u0131<\/h3>\r\n-- Komut sat\u0131r\u0131n\u0131 açmak için `:` tu\u015funa bas\u0131n\r\n\r\n-- Tüm ERROR seviyesindeki loglar\u0131 göster\r\n:filter-in log_level = 'error'\r\n\r\n-- Son 1 saatteki loglar\u0131 listele\r\nSELECT * FROM all_logs WHERE log_time >= datetime('now', '-1 hour')\r\n\r\n-- IP adresine göre gruplama (Apache\/Nginx loglar\u0131 için)\r\nSELECT c_ip, count(*) as hit_count \r\nFROM access_log \r\nGROUP BY c_ip \r\nORDER BY hit_count DESC \r\nLIMIT 10\r\n\r\n-- HTTP status kodlar\u0131n\u0131 analiz et\r\nSELECT sc_status, count(*) as count \r\nFROM access_log \r\nWHERE log_time >= datetime('now', '-1 day') \r\nGROUP BY sc_status \r\nORDER BY count DESC\r\n\r\n-- Error loglar\u0131ndaki en s\u0131k tekrar eden mesajlar\u0131 bul\r\nSELECT log_body, count(*) as frequency \r\nFROM all_logs \r\nWHERE log_level = 'error' \r\nGROUP BY log_body \r\nORDER BY frequency DESC \r\nLIMIT 5<\/code><\/pre>\r\n\r\n<\/code><\/pre>\r\nGeli\u015fmi\u015f Sorgular<\/h3>\r\n-- Zaman bazl\u0131 analiz (saatlik breakdown)\r\nSELECT strftime('%H', log_time) as hour, count(*) as request_count \r\nFROM access_log \r\nWHERE log_time >= date('now') \r\nGROUP BY hour \r\nORDER BY hour\r\n\r\n-- Response time analizi\r\nSELECT avg(duration), min(duration), max(duration) \r\nFROM access_log \r\nWHERE sc_status = 200\r\n\r\n-- Hata oran\u0131 hesaplama\r\nSELECT (SELECT count(*) FROM access_log WHERE sc_status >= 400) * 100.0 \/ \r\n (SELECT count(*) FROM access_log) as error_percentage\r\n\r\n-- Unique ziyaretçi say\u0131s\u0131\r\nSELECT count(DISTINCT c_ip) as unique_visitors \r\nFROM access_log \r\nWHERE log_time >= date('now')<\/code><\/pre>\r\n\ud83d\udcca Geli\u015fmi\u015f Özellikler<\/h2>\r\n1. Otomatik Format Alg\u0131lama<\/h3>\r\n
lnav otomatik olarak \u015fu formatlar\u0131 alg\u0131lar:<\/p>\r\n
\r\n- Apache Common\/Combined Log Format<\/li>\r\n
- Nginx access\/error logs<\/li>\r\n
- Syslog (RFC3164\/RFC5424)<\/li>\r\n
- systemd Journal<\/li>\r\n
- Docker container logs<\/li>\r\n
- PostgreSQL logs<\/li>\r\n
- MySQL logs<\/li>\r\n
- JSON structured logs<\/li>\r\n
- ve 100+ format daha...<\/li>\r\n<\/ul>\r\n
2. Custom Format Tan\u0131mlama<\/h3>\r\n
~\/.lnav\/formats\/<\/code> dizininde custom format dosyalar\u0131:<\/p>\r\ncat > ~\/.lnav\/formats\/myapp.json << EOF\r\n{\r\n \"myapp_log\": {\r\n \"title\": \"My Application Log Format\",\r\n \"description\": \"Custom log format for my application\",\r\n \"url\": \"http:\/\/example.com\/log-format\",\r\n \"regex\": {\r\n \"std\": {\r\n \"pattern\": \"^(?P\\\\d{4}-\\\\d{2}-\\\\d{2} \\\\d{2}:\\\\d{2}:\\\\d{2}) \\\\[(?P\\\\w+)\\\\] (?P.*)\"\r\n }\r\n },\r\n \"timestamp-field\": \"timestamp\",\r\n \"level-field\": \"level\",\r\n \"body-field\": \"body\"\r\n }\r\n}\r\nEOF<\/code><\/pre>\r\n3. Bookmarks ve Annotations<\/h3>\r\n <\/pre>\r\n# Önemli loglar\u0131 i\u015faretle\r\n:bookmark \"Critical error occurred\"\r\n\r\n# Annotation ekle\r\n:comment \"This error started the cascade failure\"\r\n\r\n# Bookmark listesini görüntüle\r\n:bookmarks<\/code><\/pre>\r\n\r\n<\/code><\/pre>\r\n4. Session Yönetimi<\/h3>\r\n <\/pre>\r\n# Session kaydet\r\n:save-session \/tmp\/debug-session.lnav\r\n\r\n# Session yükle\r\nlnav -s \/tmp\/debug-session.lnav\r\n\r\n# Son session'\u0131 otomatik yükle\r\nlnav -r<\/code><\/pre>\r\n\r\n<\/code><\/pre>\r\n\ud83d\udd27 Pratik Kullan\u0131m Senaryolar\u0131<\/h2>\r\nSenaryo 1: Web Server Log Analizi<\/h3>\r\n <\/pre>\r\n# Nginx access ve error loglar\u0131n\u0131 birlikte analiz\r\nlnav \/var\/log\/nginx\/access.log \/var\/log\/nginx\/error.log\r\n\r\n# SQL ile analiz\r\n:;SELECT c_ip, count(*) FROM access_log GROUP BY c_ip ORDER BY count(*) DESC LIMIT 10\r\n:filter-in sc_status >= 400<\/code><\/pre>\r\n\r\n<\/code><\/pre>\r\nSenaryo 2: Sistem Hatalar\u0131n\u0131 Takip<\/h3>\r\n <\/pre>\r\n# Systemd journal ve syslog birlikte\r\nlnav \/var\/log\/syslog\r\n# veya\r\njournalctl -f | lnav\r\n\r\n# Error ve warning seviyelerini filtrele\r\n:filter-in log_level IN ('error', 'warning')<\/code><\/pre>\r\n\r\n<\/code><\/pre>\r\nSenaryo 3: Uygulama Debug<\/h3>\r\n <\/pre>\r\n# Docker container loglar\u0131\r\ndocker logs -f myapp | lnav\r\n\r\n# Uygulama loglar\u0131 ile sistem loglar\u0131n\u0131 birle\u015ftir\r\nlnav \/var\/log\/myapp\/*.log \/var\/log\/syslog<\/code><\/pre>\r\n\r\n<\/code><\/pre>\r\nSenaryo 4: Performance Monitoring<\/h3>\r\n <\/pre>\r\n# Apache access log performance analizi\r\nlnav \/var\/log\/apache2\/access.log\r\n\r\n# SQL ile yava\u015f requestleri bul\r\n:;SELECT cs_uri_stem, avg(duration) as avg_time FROM access_log GROUP BY cs_uri_stem HAVING avg_time > 1000 ORDER BY avg_time DESC<\/code><\/pre>\r\n\r\n<\/code><\/pre>\r\n\ud83c\udfa8 Görsel Customization<\/h2>\r\nRenk \u015eemalar\u0131<\/h3>\r\n# Tema de\u011fi\u015ftirme\r\n:config theme monokai\r\n:config theme solarized-dark\r\n:config theme default\r\n\r\n# Custom renk ayarlar\u0131\r\n~\/.lnav\/configs\/default\/config.json\r\n<\/code><\/pre>\r\nHistogram Görünümü<\/h3>\r\n\r\n- Histogram aktifle\u015ftir (s tu\u015fu)<\/li>\r\n
- Zaman bazl\u0131 log da\u011f\u0131l\u0131m\u0131n\u0131 görsel olarak gösterir<\/li>\r\n
- Spike'lar\u0131 ve anomalileri kolayca tespit eder<\/li>\r\n<\/ul>\r\n
\ud83d\udea8 Troubleshooting ve En \u0130yi Pratikler<\/h2>\r\nPerformans Optimizasyonu<\/h3>\r\n# Büyük loglar için bellek kullan\u0131m\u0131n\u0131 s\u0131n\u0131rla\r\nexport LNAV_EXP_DISABLE_PRECOMPUTE=1\r\n\r\n# Index olu\u015fturmay\u0131 devre d\u0131\u015f\u0131 b\u0131rak (h\u0131z için)\r\nlnav --no-index \/var\/log\/huge.log\r\n\r\n# Sadece son N sat\u0131r\u0131 yükle\r\ntail -n 10000 \/var\/log\/big.log | lnav\r\n<\/code><\/pre>\r\nYayg\u0131n Sorunlar ve Çözümleri<\/h3>\r\n
Problem:<\/strong> Log format\u0131 tan\u0131nm\u0131yor Çözüm:<\/strong> Manual format belirtme<\/p>\r\n:open \/path\/to\/log.txt syslog\r\n<\/code><\/pre>\r\nProblem:<\/strong> Çok yava\u015f yükleniyor Çözüm:<\/strong> Streaming mode kullan<\/p>\r\ntail -f \/var\/log\/big.log | lnav -\r\n<\/code><\/pre>\r\nProblem:<\/strong> UTF-8 karakter sorunu Çözüm:<\/strong> Encoding belirt<\/p>\r\nexport LC_ALL=en_US.UTF-8\r\nlnav \/var\/log\/app.log\r\n<\/code><\/pre>\r\n\ud83d\udcc8 Monitoring ve Alerting Entegrasyonu<\/h2>\r\nScript ile Otomasyonu<\/h3>\r\n <\/pre>\r\n#!\/bin\/bash\r\n# lnav-monitor.sh\r\n\r\nERROR_COUNT=$(lnav -n -c ':;SELECT count(*) FROM all_logs WHERE log_level=\"error\" AND log_time >= datetime(\"now\", \"-5 minutes\")' \/var\/log\/app.log)\r\n\r\nif [ $ERROR_COUNT -gt 0 ]; then\r\n echo \"ALERT: $ERROR_COUNT errors in last 5 minutes\"\r\n # Send notification\r\nfi<\/code><\/pre>\r\n\r\n<\/code><\/pre>\r\nPrometheus Metrikleri<\/h3>\r\n <\/pre>\r\n# Log metrics export\r\nlnav -c ':;SELECT log_level, count(*) FROM all_logs WHERE log_time >= datetime(\"now\", \"-1 hour\") GROUP BY log_level' -n \/var\/log\/app.log | while read level count; do\r\n echo \"log_entries_total{level=\\\"$level\\\"} $count\"\r\ndone<\/code><\/pre>\r\n\r\n<\/code><\/pre>\r\n\ud83d\udd17 Di\u011fer Araçlarla Entegrasyon<\/h2>\r\nELK Stack Alternative<\/h3>\r\n# lnav + jq + curl ile basit log aggregation\r\nlnav -c ':;SELECT * FROM all_logs WHERE log_level=\"error\"' -n \/var\/log\/*.log | jq -r '. | {timestamp, level, message}' | curl -X POST -H \"Content-Type: application\/json\" -d @- http:\/\/logserver\/api\/logs\r\n<\/code><\/pre>\r\nGrafana Integration<\/h3>\r\n# JSON output ile Grafana'ya veri gönderme\r\nlnav -c ':;SELECT strftime(\"%Y-%m-%d %H:00:00\", log_time) as hour, count(*) FROM all_logs GROUP BY hour' -n \/var\/log\/app.log\r\n<\/code><\/pre>\r\n\ud83c\udf93 Pro Tips ve \u0130leri Seviye Kullan\u0131m<\/h2>\r\n1. Regular Expression Güçlü Filtreleme<\/h3>\r\n# Regex ile filtreleme\r\n:filter-in log_body REGEXP 'user_id:\\s*(\\d+)'\r\n\r\n# IP adresi pattern'i\r\n:filter-in c_ip REGEXP '^192\\.168\\.'\r\n<\/code><\/pre>\r\n2. Multi-line Log Handling<\/h3>\r\n# Java stack trace gibi multi-line loglar için\r\n:config show-time-offset true\r\n<\/code><\/pre>\r\n3. Export ve Payla\u015f\u0131m<\/h3>\r\n# Filtered loglar\u0131 export et\r\n:write-csv-to \/tmp\/filtered_logs.csv\r\n:write-json-to \/tmp\/logs.json\r\n\r\n# Screenshot benzeri text export\r\n:write-to \/tmp\/log_snapshot.txt\r\n<\/code><\/pre>\r\n4. Keyboard Shortcuts Customization<\/h3>\r\n\/\/ ~\/.lnav\/configs\/default\/keymap.json\r\n{\r\n \"key-map\": {\r\n \"x\": \":toggle-view\",\r\n \"ctrl-r\": \":reset-session\"\r\n }\r\n}\r\n<\/code><\/pre>\r\n\ud83d\udcda Kar\u015f\u0131la\u015ft\u0131rma Tablosu<\/h2>\r\n <\/h2>\r\n![\"Yüklenen](\"..\/..\/..\/uploads\/images\/6899f02d37c66_1754918957.png\")
<\/span><\/h2>\r\n\ud83c\udfaf Sonuç ve Öneriler<\/span><\/h2>\r\nlnav, log analizi için güçlü ve kullan\u0131\u015fl\u0131 bir araçt\u0131r. Özellikle:<\/p>\r\n
Kimler Kullanmal\u0131:<\/h3>\r\n\r\n- System Administrators:<\/strong> Merkezi log analizi için<\/li>\r\n
- DevOps Engineers:<\/strong> CI\/CD pipeline debugging<\/li>\r\n
- SRE Teams:<\/strong> Incident response ve post-mortem analizi<\/li>\r\n
- Developers:<\/strong> Application debugging ve performance tuning<\/li>\r\n
- Security Analysts:<\/strong> Security event correlation<\/li>\r\n<\/ul>\r\n
Kullan\u0131m Önerileri:<\/h3>\r\n\r\n- Günlük rutinde:<\/strong>
tail -f<\/code> yerine lnav -f<\/code> kullan\u0131n<\/li>\r\n- Debug sessions:<\/strong> Bookmarks ve annotations kullanarak önemli noktalar\u0131 i\u015faretleyin<\/li>\r\n
- Performance tuning:<\/strong> SQL queries ile bottleneck analizi yap\u0131n<\/li>\r\n
- Team collaboration:<\/strong> Session dosyalar\u0131n\u0131 payla\u015farak debugging sürecini h\u0131zland\u0131r\u0131n<\/li>\r\n
- Automation:<\/strong> Script'lerde lnav SQL özelliklerini kullanarak otomatik raporlar olu\u015fturun<\/li>\r\n<\/ul>\r\n
Son Tavsiyeler:<\/h3>\r\n\r\n- Interactive mode'u ö\u011frenmeye zaman ay\u0131r\u0131n<\/li>\r\n
- SQL sorgu özelliklerini master edin<\/li>\r\n
- Custom format tan\u0131mlamay\u0131 ö\u011frenin<\/li>\r\n
- Keyboard shortcuts'lar\u0131 ezberleyin<\/li>\r\n
- Regular expression filtreleme kullan\u0131n<\/li>\r\n<\/ul>\r\n
Log analizi art\u0131k karma\u015f\u0131k bir süreç olmak zorunda de\u011fil. lnav ile tail, grep, less döngüsünden kurtulun ve log'lar\u0131n\u0131z\u0131 saniyeler içinde analiz edin!<\/p>\r\n
\r\nBu rehber lnav v0.11+ sürümü baz al\u0131narak haz\u0131rlanm\u0131\u015ft\u0131r. En son özellikler için GitHub repository'yi takip edin.<\/em><\/p>\r\nEtiketler:<\/strong> linux, lnav, logs, observability, sysadmin, devops, sre, terminal, dashboard, monitoring<\/p>","excerpt":"lnav (Log File Navigator) tam bu sorunu \u00e7\u00f6zmek i\u00e7in tasarlanm\u0131\u015f devrimsel bir ara\u00e7t\u0131r.","created_at":"2025-07-27 11:21:02","updated_at":"2026-09-07 16:17:37","category_id":6,"view_count":917,"reading_time":9,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-07-27 11:21:02","featured_image":"resimyok.jpg","slug":"terminalde-log-dosyalarini-gercek-zamanli-kesfet","category_name":"Sistem","category_slug":"sistem","category_color":"#3b82f6"},{"id":92,"title":"Her SOC Analistinin Bilmesi Gereken Windows Dizinleri","content":"Bir SOC (G\u00fcvenlik Operasyon Merkezi) analisti olarak, Windows'un kritik g\u00fcvenlik bilgilerini nerede depolad\u0131\u011f\u0131n\u0131 anlamak, bir s\u0131zma giri\u015fimini erken tespit etmek veya tamamen ka\u00e7\u0131rmak aras\u0131ndaki fark\u0131 yaratabilir. Her g\u00fcvenlik profesyonelinin radar\u0131nda olmas\u0131 gereken temel Windows dizinlerini inceleyelim. Kimlik Bilgileri ve Eri\u015fim Kay\u0131tlar\u0131<\/h2> Kullan\u0131c\u0131 kimlik bilgilerinin g\u00fcvenli\u011fi, her g\u00fcvenlik duru\u015funun temelini olu\u015fturur. Bu konumlar hassas kimlik do\u011frulama verilerini depolar: - C:\\Windows\\System32\\config\\SAM<\/strong>: Windows'un yerel parola hash'lerini depolad\u0131\u011f\u0131 yerdir ve bu da onu kimlik bilgisi toplama sald\u0131r\u0131lar\u0131 i\u00e7in \u00f6ncelikli bir hedef haline getirir. Bu dosyaya eri\u015fen sald\u0131rganlar, \u00e7evrimd\u0131\u015f\u0131 k\u0131rma i\u015flemleri i\u00e7in parola hash'lerini \u00e7\u0131karabilir.<\/li>
- C:\\Windows\\repair\\SAM<\/strong>: Kullan\u0131c\u0131 kimlik bilgilerinin bir yede\u011fini i\u00e7erir ve sald\u0131rganlar kimlik bilgisi h\u0131rs\u0131zl\u0131\u011f\u0131 i\u00e7in alternatif bir yol olarak hedefleyebilir.<\/li>
- C:\\Windows\\System32\\config\\SECURITY<\/strong>: Sisteminizin g\u00fcvenlik s\u0131n\u0131rlar\u0131n\u0131 tan\u0131mlayan g\u00fcvenlik politikalar\u0131n\u0131 ve eri\u015fim kontrol\u00fc ayarlar\u0131n\u0131 bar\u0131nd\u0131r\u0131r.<\/li> <\/ul>
Sistem ve Olay Kay\u0131tlar\u0131<\/h2> Etkili g\u00fcvenlik izleme, kapsaml\u0131 g\u00fcnl\u00fck tutmaya ba\u011fl\u0131d\u0131r. Bu dizinler kritik g\u00fcnl\u00fck verilerini i\u00e7erir: - C:\\Windows\\System32\\winevt<\/strong>: Windows Olay G\u00fcnl\u00fcklerini depolar, bu da SIEM korelasyonu ve g\u00fcvenlik izleme i\u00e7in \u00e7ok \u00f6nemlidir. Bu, potansiyel g\u00fcvenlik olaylar\u0131n\u0131 ara\u015ft\u0131r\u0131rken genellikle ilk dura\u011f\u0131n\u0131zd\u0131r.<\/li>
- C:\\Windows\\System32\\config\\SYSTEM<\/strong>: Yetkisiz de\u011fi\u015fiklikleri g\u00f6sterebilecek sistem genelindeki de\u011fi\u015fiklikleri ve yap\u0131land\u0131rmalar\u0131 izler.<\/li>
- C:\\Windows\\System32\\config\\SOFTWARE<\/strong>: Y\u00fckl\u00fc yaz\u0131l\u0131mlar ve de\u011fi\u015fiklikler hakk\u0131nda ayr\u0131nt\u0131lar i\u00e7eren kay\u0131t defteri bilgilerini i\u00e7erir, yetkisiz yaz\u0131l\u0131m kurulumlar\u0131n\u0131 belirlemenize yard\u0131mc\u0131 olur.<\/li> <\/ul>
K\u00f6t\u00fc Ama\u00e7l\u0131 Yaz\u0131l\u0131m ve Tehdit Avlama G\u00f6stergeleri<\/h2> Tehditleri ararken, bu konumlar genellikle de\u011ferli adli kan\u0131tlar sa\u011flar: - C:\\Windows\\Prefetch<\/strong>: Son zamanlarda \u00e7al\u0131\u015ft\u0131r\u0131lan programlar\u0131 izler, bu da bir soru\u015fturma s\u0131ras\u0131nda adli zaman \u00e7izelgeleri olu\u015fturmak i\u00e7in paha bi\u00e7ilmezdir.<\/li>
- C:\\Windows\\AppCompat\\Programs\\Amcache.hve<\/strong>: \u00c7al\u0131\u015ft\u0131r\u0131lan uygulamalar\u0131n ayr\u0131nt\u0131lar\u0131n\u0131 kaydeder, sald\u0131rganlar a\u011f\u0131n\u0131zda gezinirken yanal hareketi tespit etmek i\u00e7in m\u00fckemmeldir.<\/li>
- C:\\Users*\\NTUSER.dat<\/strong>: K\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar\u0131n kal\u0131c\u0131l\u0131k i\u00e7in s\u0131kl\u0131kla istismar etti\u011fi kullan\u0131c\u0131ya \u00f6zg\u00fc kay\u0131t defteri ayarlar\u0131n\u0131 i\u00e7erir.<\/li> <\/ul>
Kal\u0131c\u0131l\u0131k ve Ba\u015flang\u0131\u00e7 Ara\u015ft\u0131rmalar\u0131<\/h2> K\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar genellikle sistem yeniden ba\u015flatmalar\u0131ndan sonra hayatta kalmak i\u00e7in kal\u0131c\u0131l\u0131k sa\u011flar. Bu konumlar s\u0131kl\u0131kla hedef al\u0131n\u0131r: - C:\\Users*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup<\/strong>: Belirli bir kullan\u0131c\u0131 oturum a\u00e7t\u0131\u011f\u0131nda programlar\u0131 ba\u015flatan kullan\u0131c\u0131ya \u00f6zg\u00fc kal\u0131c\u0131l\u0131k mekanizmalar\u0131.<\/li>
- C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup<\/strong>: T\u00fcm kullan\u0131c\u0131lar\u0131 etkileyen k\u00fcresel ba\u015flang\u0131\u00e7 klas\u00f6r\u00fc, k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar taraf\u0131ndan yayg\u0131n olarak k\u00f6t\u00fcye kullan\u0131l\u0131r.<\/li> <\/ul> Bu kritik dizinleri d\u00fczenli olarak izleyerek, SOC analistleri yetkisiz eri\u015fimi, k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m kurulumunu ve kal\u0131c\u0131 tehditleri daha etkili bir \u015fekilde tespit edebilir. \u0130zleme stratejinize bu konumlar\u0131 dahil etmek, g\u00fcvenlik duru\u015funuzu ve olay m\u00fcdahale yeteneklerinizi \u00f6nemli \u00f6l\u00e7\u00fcde geli\u015ftirecektir. Sald\u0131rganlar\u0131n da bu konumlar\u0131n fark\u0131nda oldu\u011funu unutmay\u0131n, bu nedenle bu dizinler i\u00e7in uygun eri\u015fim kontrollerini ve izleme \u00e7\u00f6z\u00fcmlerini uygulamak, her g\u00fcvenlik ekibi i\u00e7in bir \u00f6ncelik olmal\u0131d\u0131r. EN:
Key Windows Directories Every SOC Analyst Should Monitor<\/h2> As a SOC (Security Operations Center) analyst, understanding where Windows stores critical security information can make the difference between detecting an intrusion early or missing it completely. Let's explore the essential Windows directories that should be on every security professional's radar. Credential & Access Logs<\/h2> The security of user credentials forms the foundation of any security posture. These locations store sensitive authentication data: - C:\\Windows\\System32\\config\\SAM<\/strong>: This is where Windows stores local password hashes, making it a prime target for credential dumping attacks. Attackers who gain access to this file can potentially extract password hashes for offline cracking.<\/li>
- C:\\Windows\\repair\\SAM<\/strong>: Contains a backup of user credentials that attackers may target as an alternative path to credential theft.<\/li>
- C:\\Windows\\System32\\config\\SECURITY<\/strong>: Houses security policies and access control settings that define your system's security boundaries.<\/li> <\/ul>
System & Event Logs<\/h2> Effective security monitoring depends on comprehensive logging. These directories contain critical log data: - C:\\Windows\\System32\\winevt<\/strong>: Stores Windows Event Logs, which are crucial for SIEM correlation and security monitoring. This is often your first stop when investigating potential security incidents.<\/li>
- C:\\Windows\\System32\\config\\SYSTEM<\/strong>: Tracks system-wide changes and configurations that may indicate unauthorized modifications.<\/li>
- C:\\Windows\\System32\\config\\SOFTWARE<\/strong>: Contains the registry hive with details on installed software and changes, helping you identify unauthorized software installations.<\/li> <\/ul>
Malware & Threat Hunting Indicators<\/h2> When hunting for threats, these locations often provide valuable forensic evidence: