Module 2 · Defending a small network Lesson 5 of 15
Logs: reading the story of an incident
A log is a timeline. Five hundred failed logins from one address followed by one success is a story; the same five hundred spread across a week and never succeeding is noise.
The concept
Logs are the timeline of what happened, and an incident is normally reconstructed from three sources: the web server's access log, which shows every request, the application log, which shows what the code did, and the authentication log, which shows who signed in from where and how often they failed. Reading them in time order is the whole technique.
Start from the thing you know — the time a customer reported the problem, an alert, a strange filename — and move outwards. Look for repetition (one address, hundreds of requests), for success after a run of failures (a password guessed), or for a request from a country nobody visits you from. grep, sort and uniq -c turn ten thousand lines into a shortlist.
# Failing logins, and where they come from:
sudo grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head
sudo last -f /var/log/wtmp | head # recent logins
sudo journalctl -u ssh --since "1 hour ago"
# Timeline: the first event, what changed, what was touched.Common mistakes
The mistake is trusting a dashboard summary and never opening the raw lines. Summaries are written by whoever configured them and rarely answer the question in front of you. The second mistake is deleting a log after an incident because the disk was full — export it first, then rotate.
Worked example
Logs are shown in UTC, and reading a timestamp without converting it is the most common reason an investigation goes in the wrong direction for an hour.
Your practice task
Take a sample authentication log, find the burst, convert the timestamp, and write three sentences on what happened.
Do this before moving on. Reading a solution teaches the shape of it; typing it teaches you.
Key takeaway
Logs are the timeline of what happened, and an incident is normally reconstructed from three sources: the web server's access log, which shows every request, the application log, which shows what the code did, and the authentication log, which shows who signed in from where and how often they failed. Reading them in time order is the whole technique.
Keep your place in this course
A free account saves which lessons you have finished and unlocks the certificate. The lesson itself stays free to read.
Create free account or sign inCourse complete
You finished every lesson.
Your certificate is ready, and the projects you built are the proof to attach to an application.
Almost there
15 lessons left of 15
Finish every lesson to unlock the certificate. Each one ends in a practice task — do them and the final project brief writes itself.