A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
Linux logging is not one file. Some systems retain traditional text logs such as `/var/log/auth.log`; others rely heavily on systemd-journald. Before writing a parser, identify the logging backend and the event family you care about. Authentication failures, privilege use, kernel messages, and service failures often have different fields and retention rules.
The security value of a log entry comes from context. A failed SSH login from a single source may be noise; a burst of failures followed by a success and a privilege change is a different story. Bash is good at first-pass filtering, but it is your job to preserve enough surrounding fields for later analysis.
Shows the most recent journal entries without opening a pager. The useful habit here is to treat the command output as evidence about one system fact, not as a magical diagnosis.
Tool choice is situational. Start with the narrowest command that answers the question, then escalate to a heavier tool only when the first observation leaves a real gap.
Journal output changes shape with the selected view. Human-readable output is useful for manual triage; structured output such as JSON is easier to feed to parsers when the toolchain supports it. Do not build a production detector around brittle column positions from a display format unless you control the exact formatter.
Searches a common text log format for SSH authentication failures on Debian-family systems that keep this file. Read the result in context: the same command can be correct yet insufficient if a permission boundary, alternate configuration, or different backend changes what it reports.
Uses accounting data to summarize recent login records; it is a different evidence source from the live journal. In a production workflow, save the raw result when the observation contributes to a finding. That keeps later analysis honest and makes troubleshooting reproducible.
A practitioner’s checkpoint: compare the observed behavior with the assumption your script is about to make. If the assumption is broader than the evidence, narrow the rule. If the evidence is incomplete, report the uncertainty instead of converting it into a confident finding.
Lab discipline: stay inside the declared course environment, prefer read-only checks for learning exercises, and preserve the original output of security tools before transforming it.
Finish the lesson once you have worked through the material. This awards ★ 35 XP.