A break-in nobody saw for six weeks
Security monitoring means collecting the records that systems write and watching them for signs of an attack. Without it, an intruder can stay inside for weeks and nobody knows.
A bakery chain finds out from its bank that its card payments were copied. Its servers wrote logs the whole time. Nobody read them. You will learn which records to keep and which to watch.
By the end of this lesson
Note
I can choose which logs and numbers a security team should collect and watch.
Key words
| Word | What it means | Example |
|---|---|---|
| Log | a file where a program writes down what it did | |
| Event | one thing that happened, written as one log line | |
| Metric | a number counted over time | failed sign-ins per hour |
| Signal | an event that points to a real problem | |
| Noise | events that look alarming but are normal | |
| Baseline | what normal looks like on an ordinary day |
The cells students fill in are left blank in this preview.
A log records, a metric counts
A log holds one line for every event: a sign-in, a web page request, a file change. A log tells you what happened and when.
A metric is a number made from many events, such as failed sign-ins per hour. A metric shows a trend at a glance. A log shows the detail when you need it. A security team uses both.
Worked example: one hour of a shop's sign-ins
| Kind | What it holds | Example | Good for |
|---|---|---|---|
| Log | One line per event | 10:04 Failed password for sam | Finding out who and why |
| Metric | One number per hour | 40 failed sign-ins between 10:00 and 11:00 | Seeing a jump |
| Metric | One number per hour | 3 failed sign-ins between 03:00 and 04:00 | Comparing with other hours |
The cells students fill in are left blank in this preview.
List the log folder in this lab
ls case/var/logShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Count the lines in the login log
wc -l case/var/log/auth.logShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Choose each source by the question it answers
You cannot watch everything, so start from questions. Who signed in? What did the website serve? What ran on the machine? What changed?
Each question points at a source. A security team writes the list of sources down and checks each one has a clock that is correct. Without a correct clock, events from two sources cannot be put in order.
Worked example: questions and their sources
| Question | Source | A line looks like |
|---|---|---|
| Who signed in, and from where? | The login log | Accepted password for sam from 192.0.2.5 |
| What did the website serve? | The web access log | GET /basket HTTP/1.1 200 |
| What runs on a timer? | The scheduler log | session opened for user root |
| What changed on the disk? | File change times | 2026-03-02 09:14 root /etc/passwd |
The cells students fill in are left blank in this preview.
Split a login line into words
printf 'Oct 14 10:01:00 web01 sshd[1]: Failed password for sam from 192.0.2.5 port 22 ssh2\nOct 14 10:01:05 web01 sshd[1]: Accepted password for sam from 192.0.2.5 port 22 ssh2\n' | awk '{print $6}'Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
How a tool reads a line
printf writes two example login lines. awk splits each line at the spaces and prints word number six. That word is Failed on the first line and Accepted on the second.
This is how counting works on a real log: pick the word that holds the answer, then count it.
Signal matters, noise does not
Every public machine is tried by automated programs all day. They guess passwords and ask for pages that do not exist. Most of these events are noise: normal, and not worth waking anyone for.
A signal is an event that points to a real problem. To spot one, you need a baseline: a count for an ordinary day. Ten failed sign-ins mean little if the baseline is 300.
Count the failed sign-ins in a day
grep -c "Failed password" case/var/log/auth.logShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A common mistake
Warning
Many people think a safe team logs everything and keeps it for ever. Too much data hides the signal and costs money to store. Log what answers a question you have, and keep it as long as you might need it.
Worked example: a count against its baseline
| Day | Failed sign-ins | Compared with a normal day of 300 |
|---|---|---|
| Monday | 290 | Normal |
| Tuesday | 320 | Normal |
| Wednesday | 2,100 | Seven times higher: look closely |
The cells students fill in are left blank in this preview.
Going further
Choose a small business you know, such as a gym or a bakery. Write four questions its owner would want a log to answer.
For each question, name the source that would hold the answer and say how long you would keep it.