Cybersecurity Triage
Read-only, sensitive outputRedact Secret-Looking Log Lines
Logs may contain token, password, secret, or bearer values and you need a safer view before sharing snippets.
Command
grep -RInEi '(password|token|secret|authorization)' /var/log/app /var/log/deploy.log 2>/dev/null | sed -E 's/((password|token|secret)[[:space:]]*[:=])[[:alnum:]_.-]+/\1REDACTED/Ig; s/([Aa]uthorization[[:space:]]*:[[:space:]]*[Bb]earer[[:space:]]+)[[:alnum:]_.-]+/\1REDACTED/g'Before you run this
System impact: Read-only. Output may expose users, paths, tokens, keys, IPs, process arguments, or log details.
When not to use it: Do not treat this as complete DLP; tune patterns for your real secret formats and still review output.
Expected output
Matching log lines with sensitive-looking values replaced by REDACTED.
System impact
Read-only, sensitive output. Nothing changes. The command prints matching lines with secret-looking values redacted.
May require elevated permissions on protected paths or service-owned files.
Recovery / rollback: no state is changed.
When to use it
Use before pasting incident log snippets into tickets, chat, or reports.
When not to use it
Do not treat this as complete DLP; tune patterns for your real secret formats and still review output.
next steps
Related commands
Review a Breakglass Account
Emergency accounts should be easy to find and hard to ignore.
sudo grep -Rhn 'breakglass' /etc /home /var/log/auth.log 2>/dev/null
Show Successful Logins and sudo Use
Access reviews need both who logged in and who elevated privileges.
grep -E 'Accepted publickey|sudo:' /var/log/auth.log 2>/dev/null
Summarize sudo Commands by User
Privilege history is easier to review when users and commands are separated.
sed -n 's/.*sudo: *\([^: ]*\).*COMMAND=\(.*\)$/\1 -> \2/p' /var/log/auth.log 2>/dev/null | sort
Find World-Readable Secret-Looking Files
The fastest secret audit starts with readable files that look like secrets.
find /srv/www/example -type f -perm -0004 \( -iname '*secret*' -o -iname '*.env' -o -iname '*token*' -o -iname '*key*' \) -printf '%M %u:%g %p\n' 2>/dev/null | sort
Build a Deploy and Restart Timeline
Deploys and restarts are incident landmarks.
grep -Eh 'deploy|release|restart|started|stopped|rolled back' /var/log/app/*.log /var/log/deploy.log 2>/dev/null | sort
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.