Block 1 Lab 2 — Reading & Filtering Logs at the CLI

Scenario

It's 09:15 on a Monday. Three users have reported that logins to rhel-prod-01 were failing overnight. You need to find out when it started, how many failures there were, which usernames were targeted, and whether any succeeded. The logs are all you have. No editor. Just the CLI.

Objectives

#	Objective
1	Use tail to read the end of a log file and follow it live
2	Use grep to extract failed login attempts from /var/log/secure
3	Filter by time window — isolate events from a specific hour
4	Use awk to extract specific fields from log lines
5	Use cut and sort \| uniq -c to count and rank attackers by IP
6	Knowledge check — log triage concepts

Supported Commands

Command	Purpose
tail [-n N] [-f] <file>	Last N lines; -f follows live output
head [-n N] <file>	First N lines of a file
cat <file>	Print full file (avoid on large logs)
grep [-i] [-v] [-c] [-E] <pattern> <file>	Filter lines matching pattern
grep "pattern" file \| grep "pattern2"	Chain greps to narrow results
awk '{print $N}' <file>	Extract field N from each line
cut -d'<delim>' -f<N> <file>	Cut field N using delimiter
sort \| uniq -c \| sort -rn	Count and rank repeated values
wc -l <file>	Count lines

Pipes ( | ) chain commands together. The output of one becomes the input of the next. Most log triage one-liners are 2–3 commands piped together.

Use Tab to complete · ↑↓ for history · Type ? for help

🖥 Server State

🐧

rhel-prod-01

RHEL 9.3 · root@host

sshdactive (running)

/var/log/securenot read

failuresunknown

attackersnot identified

Log Files

auth logs

📄 secure active

📄 secure-20240310

system logs

📄 messages

📄 cron

extracted

📋 failures found

📋 IPs ranked

—

[root@rhel-prod-01 ~]#

📋 Tasks & Guide

Lab Information

—