Advanced · 14 min · practise every command in the built-in terminal

🎯 Mission Briefing: Midnight Log Hunt

Customers report intermittent failures, but nothing is on fire right now — the kind of bug that only shows up in the logs, hours after it happened. Time to go spelunking through the journal.

Your objective

Search the system logs for authentication failures, narrow down how many happened, and cross-check against known accounts.

Investigation toolkit

journalctl -n 50                       # Recent system-wide activity
journalctl -u sshd -p err              # Errors from the SSH service
journalctl -u sshd | grep -i fail      # Filter for failure mentions
cut -d: -f1 /etc/passwd                # Cross-check against known accounts

Report your findings

journalctl -u sshd -p err | wc -l

A thorough investigation ends with a number and a service name — not just a hunch.

Practice tasks

  1. Check the last 50 lines of system-wide logs
  2. Check sshd logs for errors specifically
  3. Filter sshd logs for anything mentioning failures
  4. Count how many error-level sshd log lines there are
  5. Cross-check the list of real user accounts

Commands in this lesson

Missions