Cybersecurity Triage
Read-only, sensitive outputShow Successful Logins and sudo Use
You need a compact access timeline from auth logs that includes successful SSH logins and sudo commands.
Command
grep -E 'Accepted publickey|sudo:' /var/log/auth.log 2>/dev/nullBefore you run this
System impact: Read-only. Output may expose users, paths, tokens, keys, IPs, process arguments, or log details.
When not to use it: Do not treat this as a complete audit trail; also check rotated logs, system journal, and identity-provider logs on real systems.
Expected output
Accepted SSH login lines and sudo command lines in log order.
System impact
Read-only, sensitive output. Nothing changes. The command filters the system auth log for successful access and privilege-use lines.
May require elevated permissions on protected paths or service-owned files.
Recovery / rollback: no state is changed.
When to use it
Use during first response, server handoff, or after a suspicious change to build a quick access timeline.
When not to use it
Do not treat this as a complete audit trail; also check rotated logs, system journal, and identity-provider logs on real systems.
next steps
Related commands
Review a Breakglass Account
Emergency accounts should be easy to find and hard to ignore.
sudo grep -Rhn 'breakglass' /etc /home /var/log/auth.log 2>/dev/null
Summarize sudo Commands by User
Privilege history is easier to review when users and commands are separated.
sed -n 's/.*sudo: *\([^: ]*\).*COMMAND=\(.*\)$/\1 -> \2/p' /var/log/auth.log 2>/dev/null | sort
Show Accepted SSH Logins
During first response, successful logins matter more than background noise.
grep 'Accepted publickey' logs/auth.log
Redact Secret-Looking Log Lines
Incident notes should not copy secrets forward.
grep -RInEi '(password|token|secret|authorization)' /var/log/app /var/log/deploy.log 2>/dev/null | sed -E 's/((password|token|secret)[[:space:]]*[:=])[[:alnum:]_.-]+/\1REDACTED/Ig; s/([Aa]uthorization[[:space:]]*:[[:space:]]*[Bb]earer[[:space:]]+)[[:alnum:]_.-]+/\1REDACTED/g'
Review sudo Grants
Privilege paths should be visible before you remove or approve access.
awk -F: '$1=="sudo" {print "sudo group: " $4}' /etc/group; sudo grep -RhnE '^[^#].*ALL=' /etc/sudoers /etc/sudoers.d 2>/dev/null
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.