Reading logs without drowning

Open it, then filter it

Evidence files are plain text. Start by sizing one up — how many lines is it?

wc -l /srv/soc-data/linux/auth.log
head -n 3 /srv/soc-data/linux/auth.log

In the terminal

student@vulntech:~$ wc -l /srv/soc-data/linux/auth.log
55 /srv/soc-data/linux/auth.log
student@vulntech:~$ head -n 3 /srv/soc-data/linux/auth.log
Mar 10 06:12:04 web01 sshd[8801]: Accepted publickey for deploy from 10.10.10.20 port 51022 ssh2: RSA SHA256:aaa
Mar 10 06:12:04 web01 sshd[8801]: pam_unix(sshd:session): session opened for user deploy(uid=1002) by (uid=0)
Mar 10 07:14:11 web01 sshd[9000]: Failed password for root from 203.0.113.66 port 40007 ssh2

You rarely read a log top to bottom. You filter. grep prints only the lines that match a pattern — the single most important skill on this desk:

grep 'Accepted password' /srv/soc-data/linux/auth.log

In the terminal

student@vulntech:~$ grep 'Accepted password' /srv/soc-data/linux/auth.log
Mar 10 08:03:52 web01 sshd[9140]: Accepted password for svc-backup from 203.0.113.66 port 40511 ssh2

That one line is the whole case in miniature: an account was accepted over SSH from an external address. Hold onto that address — it is your prime suspect.

Tip: grep -c PATTERN FILE counts matching lines instead of printing them, and grep -i ignores case. You will lean on both constantly.