Evidence pipelines · approximately 6 minutes · no timer

Find the rejected logins

Inspect /var/log/training-auth.log. Save only denied events to lab/denied.txt and their newline count to lab/count.txt. Leave the original log intact.

learner@clairos:~ $

↑ history · Tab complete · Ctrl+C cancel · Esc, Tab to leaveExit 0

Your recovery goal

The evidence file contains exactly the denied records and the count artifact agrees.

Investigation in progress.

Show a recovery path

Use this as a worked example, not the only accepted command sequence.

grep denied /var/log/training-auth.log | tee lab/denied.txt | wc -l > lab/count.txt

Two stars for resolution; a third for diagnostic evidence. Practice rewards are session-only when signed out and device-local when signed in.

What did the evidence establish?

Separate the failing condition from your explanation of its cause. After a repair, verify the result at the layer the user actually depends on. A changed file, successful syntax check, running process, and successful request prove different things.

Choose another incident Return to the curriculum