Lab — Hunt Through Logs

Real /var/log/auth.log (or /var/log/secure) belongs to the operating system. Reading it on a machine you administer is normal. Rewriting it, deleting it, or grepping a server you do not own is not a lab — it is an incident or unauthorized access. A practice file with the same English phrases (Failed password, Accepted password) trains your eyes without harming evidence.

Synthetic lines also let you control the signal. You plant three failures and two accepts, then prove your pipeline finds them. If you only ever practice on a quiet home laptop's empty auth.log, you learn "grep returned nothing" instead of "here is the count." Controlled data teaches measurement.

Chain of custody mindset still applies: do not alter the only copy of real logs; work on copies. Here the original is fake by design, but you still write a report file separately (auth-hunt-report.txt) so raw and findings stay distinct — a habit that transfers to real IR.

Good is specific: grep -c "Failed password" sample-auth.log gives a number you can defend. grep "Accepted" sample-auth.log lists successes you can skim. Piping to tee or redirecting >> report.txt preserves the work. Vague is scrolling the whole file in nano and saying "there were some fails." Numbers and saved output beat vibes.

Case and spacing matter. Auth logs are usually consistent, but -i can help when formats differ. Quote patterns so the shell does not eat spaces. Prefer fixed strings first; jump to fancy regex only when the simple pattern misses. Analysts escalate complexity on purpose, not for sport.

wc -l on the sample tells you total volume; comparing fail count to total is a tiny triage ratio. head and tail spot-check that your sample file looks like a log (timestamps, sshd, messages) before you trust counts. Garbage in, confident nonsense out — verify the artifact first.

mkdir -p $HOME/cyberlium-lab/logs. Create sample-auth.log with several lines you type or paste — include at least Failed password and Accepted password (or Accepted publickey). Keep it short: ten to twenty lines is enough. Then run counted greps and append results to auth-hunt-report.txt with echo headers and date/whoami.

Example mental pipeline: echo "=== fails ===" >> report; grep -c "Failed password" sample >> report; echo "=== accepts ===" >> report; grep "Accepted" sample >> report. Read the report with less. If counts are zero, fix your sample — do not invent sudo or touch /var/log/auth.log to "get real data" on a machine where that is out of scope or unauthorized.

Ethics: do not upload real production logs with user IPs and usernames into a public chat to ask for homework help. This lab's fake lines avoid that leak. If you later analyze real logs at work, follow your org's handling rules. Cyberlium practice stays under your home lab folder.

Run the block below on your VM/WSL. Adjust planted lines if you like, but keep the Failed password and Accepted phrases so patterns match. End by reading your report aloud once — if you cannot explain a number, the hunt is incomplete.

mkdir -p "$HOME/cyberlium-lab/logs"
cd "$HOME/cyberlium-lab/logs" || exit 1

cat > sample-auth.log << 'EOF'
Jan 10 09:01:01 lab sshd[1001]: Failed password for invalid user admin from 203.0.113.10 port 51234 ssh2
Jan 10 09:01:04 lab sshd[1001]: Failed password for invalid user admin from 203.0.113.10 port 51234 ssh2
Jan 10 09:01:08 lab sshd[1001]: Failed password for root from 203.0.113.10 port 51235 ssh2
Jan 10 09:15:22 lab sshd[1002]: Accepted password for sam from 198.51.100.8 port 4242 ssh2
Jan 10 10:02:11 lab sshd[1003]: Failed password for sam from 203.0.113.44 port 60001 ssh2
Jan 10 10:44:01 lab sshd[1004]: Accepted publickey for sam from 198.51.100.8 port 4243 ssh2
EOF

REPORT="$HOME/cyberlium-lab/auth-hunt-report.txt"
{
  echo "date: $(date)"
  echo "whoami: $(whoami)"
  echo "total lines: $(wc -l < sample-auth.log)"
  echo "failed_count: $(grep -c 'Failed password' sample-auth.log)"
  echo "=== Accepted lines ==="
  grep 'Accepted' sample-auth.log
} > "$REPORT"

cat "$REPORT"

sudo rm /var/log/auth.log
grep other people's servers without permission

You now have a miniature IR loop: controlled evidence, grep counts, saved report, verification. That is how log work stays honest. Next up — Quiz — Pipes & Search — checks whether you can choose grep, head/tail, and find without a scrollback crutch.