grep, head, tail, and wc

grep pattern file prints lines that match. It streams; it does not load the file as a pretty document. That is why you can hunt in a multi-gigabyte log when nano would choke. Start specific: quote the pattern so the shell does not expand *, and search files you own until you know what you are looking at. grep is a filter, not a license to rummage through other users' private notes on a shared host.

Essential flags you will actually use: grep -i ignores case (Failed, FAILED, failed). grep -n prints line numbers so you can cite findings. grep -v inverts the match (drop noise). grep -E enables extended regex (alternation with |). grep -F treats the pattern as fixed string (no regex metacharacters). grep -c counts matching lines instead of printing them. Combine thoughtfully: grep -in "failed" auth-sample.txt.

Context flags save time: grep -A 2 -B 2 pattern shows two lines after and before each hit. grep -C 3 is symmetric context. On huge files, prefer a tight pattern first; wide context on a noisy match floods the terminal. Pipe later: you already practiced pipes — grep … | head keeps the first hits when a pattern is too broad.

head prints the beginning of a file (default 10 lines). head -n 20 file shows twenty. tail prints the end — perfect for "what just happened." tail -n 50 file. tail -f file follows new lines as they are appended (Ctrl+C to stop). Use follow mode on logs you own or are allowed to watch; do not attach to strangers' sessions.

wc counts. wc -l file is line count — the fastest way to answer "how many events?" after a grep. wc -w and wc -c count words and bytes. Pipeline classic: grep -i failed sample.log | wc -l. That number is a finding you can put in a report without pasting a thousand lines.

Combine tools into a habit: head to understand format, grep to select, wc -l to quantify, tail to see the newest slice. Redirect results to a file you own: grep -n "Failed password" sample.txt > hunt-report.txt. Evidence you save under $HOME/cyberlium-lab is reproducible; scrolling alone is not.

Create a fake auth-style file with echo/printf lines containing Failed password, Accepted, Invalid user — all fiction. Practice grep on that. If you administer your own VM and want real /var/log/auth.log, read with permissions you already have (sometimes sudo less); never exfiltrate other tenants' logs from a shared school server for "portfolio screenshots."

Regex greed and false positives: grepping for root matches paths and usernames and dictionary words. Tighten patterns ("Failed password for root") or use -w for word boundaries when appropriate. Case folding with -i helps inconsistent loggers. Fixed-string -F helps when the needle contains dots or brackets.

Performance mindset: start in a small file. Confirm the pattern. Then widen. grep -R across / on a shared host is noisy, slow, and often permission-denied spam — prefer find/locate later for names, and keep recursive content search under $HOME/cyberlium-lab until you have a clear, authorized scope.

The commands below create fiction events, then demonstrate the toolkit. Adjust patterns once you see the lines. End with a count you could put in a one-line summary.

mkdir -p "$HOME/cyberlium-lab/m05-grep"
cd "$HOME/cyberlium-lab/m05-grep" || exit 1

cat > auth-sample.txt <<'EOF'
sshd[1001]: Invalid user admin from 203.0.113.10
sshd[1002]: Failed password for invalid user admin from 203.0.113.10
sshd[1003]: Failed password for root from 198.51.100.8
sshd[1004]: Accepted publickey for ana from 192.0.2.40
sshd[1005]: Failed password for ana from 198.51.100.8
sshd[1006]: pam_unix(sshd:auth): authentication failure
sshd[1007]: Accepted password for ana from 192.0.2.40
sshd[1008]: Failed password for root from 203.0.113.10
EOF

echo '--- format sample (head) ---'
head -n 3 auth-sample.txt

echo '--- case-insensitive Failed ---'
grep -in 'failed' auth-sample.txt

echo '--- count failed lines ---'
grep -i 'failed' auth-sample.txt | wc -l

echo '--- newest slice (tail) ---'
tail -n 3 auth-sample.txt

echo '--- invert: drop Accepted ---'
grep -v 'Accepted' auth-sample.txt | head

{
  echo "failed_count=$(grep -ci 'failed' auth-sample.txt)"
  echo "accepted_count=$(grep -ci 'accepted' auth-sample.txt)"
} | tee hunt-report.txt

tail -f auth-sample.txt

grep -R password /home/otherusers

You can slice with head/tail, select with grep flags, quantify with wc, and keep hunts inside authorized files. Next — find, which, and locate — switches from searching inside contents to locating files and binaries by name and path.