Home / Labs / Correlate the Logs

Correlate the Logs

One log tells part of the story. Connect the dots across auth.log, syslog, and messages.

Open this lab

Commands practised here

• cat /var/log/auth.logShows authentication attempts.
• cat /var/log/syslogShows firewall decisions and kernel events.
• cat /var/log/messagesShows application-level actions.
• grep '192.168.1.50' /var/log/syslogTraces all firewall events for the attacker IP.

Nearby labs

• All labsBrowse the full list.
• Exam prepWhich exams these objectives map to.
• Connect the Dots
• Triage the Logs