Why this matters
Many servers, cloud systems and security tools run on Linux, and adverts for analyst roles name Linux alongside Windows. When an alert points at a Linux server, you will need to read its logs from the command line, often with no mouse and no pictures.
Moving around
The command line takes typed commands. A few essentials:
pwd # where am I?
ls -l # list files with details
cd /var/log # go to the log folder
less auth.log # read a file page by pageReading and searching logs
On Ubuntu, login activity is usually recorded in /var/log/auth.log. Other Linux families use different names, such as /var/log/secure, and some newer systems keep logs only in the system journal, read with the journalctl command. Logs are long, so you search them:
grep "Failed password" /var/log/auth.log
grep "Failed password" /var/log/auth.log | wc -l
tail -n 20 /var/log/auth.logThe first command shows lines containing "Failed password". The second counts them. The third shows the last 20 lines. Reading logs usually needs administrator rights, so on real systems you may type sudo first, and only on systems you are allowed to manage.