With root privilege you can erase all of the audit logs. A malicious attack probably would do so if he/she cares about that.
Re:Linux workstation security checklist
by fluidcruft on Saturday August 29, 2015 @01:10PM
(#10140659)
You can't erase remote logs, or logs written to a write-only logging device (the one's I've seen seem essentially to be a serial port/usb device that emulates a line printer).
Yes, but it keeps an audit trail of who's account was compromised, etc.