Unit 8: Logs and the timeline · Lesson 1 of 8 · 14 min
Where the logs are
Find today's and yesterday's logs and check you can read them.
mission
- You are
- You are starting the log review for web01.
- Situation
- Logs rotate: today's lines go to auth.log, yesterday's were renamed auth.log.1. Investigations that read only today miss half the story.
- Goal
- Locate the authentication and web logs and size them up.
- Hand in
- Which files cover 13 and 14 October and how many lines each has.
List the logs that matter
ls -l auth.log* nginx/access.log
-rw-r----- 1 root adm 57241 Oct 14 23:59 auth.log
-rw-r----- 1 root adm 7877 Oct 13 23:59 auth.log.1
-rw-r----- 1 root adm 277331 Oct 14 23:59 nginx/access.log
you should see Group adm can read all three, and you are in adm.
Check the date range of each
head -n 1 auth.log.1 | cut -c1-15; tail -n 1 auth.log.1 | cut -c1-15 Oct 13 00:17:01 Oct 13 23:17:02 wc -l auth.log auth.log.1 548 auth.log 77 auth.log.1 625 total
defender tip Older rotations are usually compressed as .gz. zgrep and zcat read them without unpacking.
Logs on Ubuntu servers
| Command | What it does |
|---|---|
/var/log/auth.log | Logins, sudo, SSH |
/var/log/syslog | Everything else from services |
/var/log/nginx/ | Web requests and errors |
journalctl | The systemd journal on hosts that use it |
Find logs by date
-t sorts newest first.
ls -lt --time-style=+%F /var/log/auth.log* /var/log/nginx/access.log | awk '{print $6, $7}'
2026-10-14 /var/log/auth.log
2026-10-14 /var/log/nginx/access.log
2026-10-13 /var/log/auth.log.1
you should see Today's files first, then yesterday's rotated auth log.
What a defender takes away
- 1Rotated logs hold yesterday and earlier.
- 2Check the first and last timestamps before you trust a file.
- 3Read access comes from group adm.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.