Opening a log and finding the clue

Don't read the whole book. Search it.

A log is just a text file, one event per line. Real logs have thousands of lines, so you never read them top to bottom. You search them. The tool for that is grep: it prints only the lines that contain the word you ask for.

Here is a tiny login log. First we look at the whole thing, then we search it:

cat /tmp/auth.log

In the terminal

student@vulntech:~$ cat /tmp/auth.log
Mar 10 09:12:01 host sshd[2211]: Failed password for root from 198.51.100.23 port 51110 ssh2
Mar 10 09:12:03 host sshd[2213]: Failed password for root from 198.51.100.23 port 51114 ssh2
Mar 10 09:12:06 host sshd[2219]: Accepted password for root from 198.51.100.23 port 51120 ssh2

Two failures then a success, all from the same address. Now pull out just the failures, then just the success:

grep 'Failed password' /tmp/auth.log
grep 'Accepted password' /tmp/auth.log

In the terminal

student@vulntech:~$ grep 'Failed password' /tmp/auth.log
Mar 10 09:12:01 host sshd[2211]: Failed password for root from 198.51.100.23 port 51110 ssh2
Mar 10 09:12:03 host sshd[2213]: Failed password for root from 198.51.100.23 port 51114 ssh2
student@vulntech:~$ grep 'Accepted password' /tmp/auth.log
Mar 10 09:12:06 host sshd[2219]: Accepted password for root from 198.51.100.23 port 51120 ssh2

That one Accepted password line is the whole story in miniature: someone guessed the password and got in, from the address 198.51.100.23. That address is your number-one suspect, and you will keep seeing it.

Tip: grep -c word file counts matching lines instead of printing them, and grep -i ignores capital letters. Those two cover most of what you need.