Reading the time on each line

When did it happen?

Almost every log line starts with a timestamp — the date and time the event happened. Once you can read it, you can answer the two questions every investigation needs: what happened and when.

grep 'Accepted password' /tmp/auth.log

In the terminal

student@vulntech:~$ grep 'Accepted password' /tmp/auth.log
Mar 10 09:14:07 host sshd[7005]: Accepted password for root from 203.0.113.45 port 50020 ssh2

Here the successful login happened at 09:14:07 on Mar 10. Hold onto that time — now you can check what else happened right after it in other logs.

Tip: If you only want the time out of a line, grep -oE '[0-9]{2}:[0-9]{2}:[0-9]{2}' pulls out just the HH:MM:SS part.