Two logs, two ways of writing the time
A timeline is a list of events from one or more logs, put in time order. It shows what happened first, what followed, and how long each step took.
Building one is the main skill of a forensic investigator, because no single log tells the whole story.
By the end of this lesson
Note
I can rebuild a timeline of events from more than one log.
Key words
| Word | What it means | Example |
|---|---|---|
| Log line | one entry in a log: a time and a message | |
| Timestamp | the date and time written on a log line | |
| Time zone | the offset from universal time | +0000 |
| Clock skew | a clock that is a little fast or slow | |
| Correlation | linking events in different logs that belong together | |
| Timeline | events from many logs in time order |
The cells students fill in are left blank in this preview.
Every log writes the time its own way
A login log line starts with the month and day, such as Oct 14 02:11:03. It has no year and no time zone.
A web server log writes [14/Oct/2026:02:11:03 +0000]. It has the year, and it says the zone is universal time. To put the two together, you first make them agree.
Which dates are in the login log?
cut -c1-7 case/var/log/auth.log | sort -uShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Which dates are in the web log?
cut -d'[' -f2 case/var/log/nginx/access.log | cut -c1-11 | sort -uShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Worked example: the same moment in two logs
| Log | How it writes the time | What is missing |
|---|---|---|
| Login log | Oct 14 02:11:03 | The year and the zone |
| Web log | [14/Oct/2026:02:11:03 +0000] | Nothing |
| Common form | 2026-10-14 02:11:03 | Nothing, and it sorts as text |
The cells students fill in are left blank in this preview.
Regular events are the background
Most lines in a log are routine. A scheduled job leaves a line at the same moment each time, like a heartbeat.
If you know the schedule, you know how many lines to expect. A count that does not match the schedule is a clue worth following.
How often does root's job open sessions?
grep -c "session opened for user root" case/var/log/auth.logShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
The first three of those times
grep "session opened for user root" case/var/log/auth.log | cut -c8-15 | head -n 3Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Worked example: lines to expect in a day
| Schedule | Runs an hour | Lines in 24 hours |
|---|---|---|
| Once an hour | 1 | 24 |
| Every 30 minutes | 2 | 48 |
| Every 15 minutes | 4 | 96 |
The cells students fill in are left blank in this preview.
Merge the logs by time, not by text
To build a timeline, take the time out of each line, write all times in one form, and merge the lines in time order.
Then link events that belong together. This is correlation. For example, a web request and a login a minute later from the same address may be one story.
A common mistake
Warning
Many people think you can join two logs and sort all the lines as text. A login line starts with a month, but a web line starts with an address. Sorting as text groups by the first letters and not by the time. Take the time out of each line and sort by that.
Merge two short logs
a = ["02:11:03 login failed", "02:14:40 login ok"]
b = ["02:12:00 page /admin", "02:20:00 page /home"]
both = a + b
both.sort()
# Change the times in b and press Run again.
for line in both:
print(line)