Advanced Linux CLI: Filter the Evidence

Week 4 taught you how to move through Linux and inspect files without changing them blindly.

This week adds a new skill:

reduce a large body of text to the lines that answer your question.

Defenders rarely read thousands of log lines one by one. They combine small command-line tools so each stage performs one understandable job.

Pipes connect commands

The pipe operator sends the output of one command into another:

command_a | command_b

Example:

cat login-events.txt | grep "FAILED"

A more direct form is often:

grep "FAILED" login-events.txt

The key concept is the same: one stage produces data and another stage filters or transforms it.

Count matching events

Suppose the supplied synthetic log contains failed authentication events.

You can combine tools:

grep "FAILED" login-events.txt | wc -l

This asks:

1. find lines containing FAILED
2. count the resulting lines

The output is a count of matching log lines, not a count of attackers.

That distinction matters.

Sort and count repeated values

A teacher-provided simplified log contains usernames in one column.

A bounded pipeline might be:

cut -d' ' -f4 login-events.txt | sort | uniq -c

The exact command depends on the supplied format.

Conceptually:

• cut selects a field
• sort groups identical values together
• uniq -c counts repeated adjacent values

Do not memorize the pipeline without understanding the data format.

If the fields change, the command may produce nonsense.

Redirection writes output

The > operator writes command output to a file.

Example:

grep "FAILED" login-events.txt > failed-events.txt

This changes system state by creating or replacing a file.

That means redirection belongs in the authorization boundary.

Before using it, verify:

• approved output location
• whether the file already exists
• whether overwriting is acceptable

Use >> only when the lab specifically intends to append rather than replace.

Build a pipeline one stage at a time

Do not write a long pipeline and hope it works.

Use this process:

1. run the first command
2. inspect output
3. add one filter
4. inspect again
5. add counting or formatting only after the earlier stages are correct

This produces a debuggable evidence trail.

Synthetic log lab

A teacher provides auth.log with fictional records.

Answer these questions using approved commands:

1. How many lines contain FAILED?
2. Which fictional usernames appear in failed events?
3. Which username appears most often?
4. How many SUCCESS lines exist?
5. Which time range contains the largest cluster of failures?

For every answer, record the command that produced the evidence.

Command-output table

Complete all five rows.

Search recursively with care

A command such as grep -R can search through directories.

That also means it can reach more files than a single-file search.

Use it only inside the teacher-approved lab directory.

Broad search power does not expand your authorization.

Evidence for Lesson 1

Submit:

• five-question log analysis
• command-output table
• one pipeline built and documented stage by stage
• one paragraph explaining why a count of failed log lines is not the same as a count of attackers

Finish with:

A good pipeline makes the evidence smaller without making the claim bigger because ________.

Command-line power is useful when every stage remains explainable.