Linux & the Command Line / Servers and scripts
Lesson 30 of 30
Reading system logs
Logs live in /var/log and in the journal. auth.log shows logins and sudo use, which makes it the first place to look after something suspicious.
Key points
- /var/log/auth.log for logins
- journalctl -p err shows errors
- last shows recent logins
sudo grep 'Accepted' /var/log/auth.log
last -n 10Quiz · +10 XP
Which log shows SSH logins on Ubuntu?
Log in to save progress and earn XP.