CoreQ Academy My progress
READDEMOGUIDED LABINDEPENDENT LABQUIZREVIEW
Module 3 of 7 · 30 min

Reading and searching text

Beginner · 2/5

Written by CoreQ Academy (drafted with AI assistance). Awaiting review by Sean Ofodile.

You will be able to
  • Read logs with head, tail and grep
  • Chain commands with pipes
  • Summarise data with sort, uniq -c, cut and wc

Pipes

The | character sends one command's output into the next command's input. Small tools combine into powerful ones.

$ cat access.log | cut -d " " -f 1 | sort | uniq -c | sort -rn | head -3

grep finds lines

grep PATTERN FILE prints matching lines. -i ignores case, -v inverts the match, -c counts and -o prints only the matching part.

Counting what matters

sort | uniq -c | sort -rn is the classic "top N" pattern: group identical lines, count them, then rank by count.

Why logs are protected

Auth logs reveal usernames and attack patterns, so they are readable only by root and the adm group. Use sudo and expect to be audited for it.

Demo: try these in the terminal

head -n 3 /var/log/nginx/access.logpeek at the format
grep 404 /var/log/nginx/access.logfind failed requests
cut -d ' ' -f 1 /var/log/nginx/access.log | sort | uniq -c | sort -rnrank clients by request count
sudo grep -c "Failed password" /var/log/auth.logcount failed logins

Quiz

Knowledge quiz · pass mark 80%
  1. Which command shows the last 20 lines of a file?
  2. Order the pipeline that ranks repeated lines from most to least common.
    1. sort -rn
    2. sort
    3. uniq -c
  3. Count lines containing ERROR in app.log.
    $
  4. In a space-separated log, how do you print only the first field?
  5. From the lab auth log, which details make 203.0.113.45 suspicious? (choose all)
  6. What does | do?
  7. Which grep option shows lines that do NOT match?
  8. A regular user can usually read /var/log/auth.log without sudo.