Mail delivery software, for instance, maintains a record of delivery attempts, and the cron daemon for unattended command execution has its own activity logs. Each individual logfile gives its own limited view of what happened on a system, and that view may be completely wrong when an intruder has had opportunity to tamper with the record. The next couple of paragraphs focus on how multiple sources of information must be correlated before one can make a sensible judgment. The examples are UNIX specific, but that is hardly relevant. Each source of information is shown at a different indentation level.
Time proceeds from top to bottom.
The TCP Wrapper logs connection events only, so there is no corresponding record for the end of the telnet connection. For convenience, the record is shown at the two times that correspond with the beginning and the end of the login session. The order of the records is the order in which each process terminated. This question will come up again and again in this series. Intruders routinely attempt to cover their tracks.