Log Detective
The web server had a bad night. Its log, /var/log/webapp/access.log, has thousands of lines. Investigate with head, tail, less and file. Tip: in less, type / followed by a word to search.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
In less, G jumps to the end and g to the start. q quits.
Solution explanation
head -n 1 and tail -n 1 show the first and last lines. In less, /ALERT jumps straight to the only alert: ALERT login burst from 203.0.113.66 (code X-4471). file ignores the .jpg name and reports gzip compressed data.
Show solution
head -n 1 /var/log/webapp/access.log
tail -n 1 /var/log/webapp/access.log
less /var/log/webapp/access.log
file evidence/holiday.jpg