Log tampering prevention for high availability environments

A computer program product comprising one or more computer readable storage media having program instructions collectively stored on the one or more computer readable storage media, the program instructions executable to:

• monitor, in a high-availability environment, an operating system of a server that serves content to client computing devices, wherein the server maintains log files, and wherein the monitoring is performed by a daemon running on the server and comprises the daemon listening for predefined navigation commands and predefined file action commands received at the operating system;
• flag the predefined navigation commands navigating to or requesting permission over one or more log files or a folder having the one or more log files as a warning, and the predefined file action commands to remove or edit the one or more log files as a warning or a threat respectively;
• filter all commands to pause file actions based on the predefined navigation commands and the predefined file action commands from being sent to a kernel of the operating system for execution;
• determine whether the predefined navigation commands and the predefined file action commands received from a user are indicative of tampering with the one or more log files, wherein the determining comprises:
• causing the daemon to run in a secure mode based on identifying a first one of the commands received at the operating system as being one of the predefined navigation commands;
• and
• identifying, while the daemon is running in the secure mode, a second one of the commands received at the operating system as being one of the predefined file action commands;
• and
• in response to the determining that the commands are indicative of tampering with the one or more log files, perform, by the daemon, a predefined security action, comprising:
• creating a copy of the one or more log files;
• renaming the one or more log files;
• and
• sending an alert to a system administrator including the copy of the one or more log files and the renamed one or more log files.

A system comprising:

• a processor, a computer readable memory, one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instructions executable to:
• monitor, in a high-availability environment, an operating system of a server that serves content to client computing devices, wherein the server maintains log files, and wherein the monitoring is performed by a daemon running on the server and comprises the daemon listening for predefined navigation commands and predefined file action commands received at the operating system;
• flag the predefined navigation commands navigating to or requesting permission over one or more log files or a folder having the one or more log files as a warning, and the predefined file action commands to remove or edit the one or more log files as a warning or a threat respectively;
• filter all commands to pause file actions based on the predefined navigation commands and the predefined file action commands from being sent to a kernel of the operating system for execution;
• determine whether the predefined navigation commands and the predefined file action commands received from a user are indicative of tampering with the one or more log files, wherein the determining comprises:
• causing the daemon to run in a secure mode based on identifying a first one of the commands received at the operating system as being one of the predefined navigation commands;
• and, while the daemon is running in the secure mode, identifying a second one of the commands received at the operating system as being one of the predefined file action commands;
• in response to the determining that the commands are indicative of tampering with the one or more log files, perform, by the daemon, a predefined security action comprising:
• creating a copy of the one or more log files;
• renaming the one or more log files;
• and
• sending an alert to a system administrator including the copy of the one or more log files and the renamed one or more log files;
• and
• send the second one of the commands to a kernel of the operating system for execution based on the user successfully authenticating or validating via the predefined security action.