Lessons · Cybersecurity · reading a log line
One log line, four questions
Every useful log line answers when it happened, where it came from, what was attempted, and whether it worked.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
What it is for
At 3 a.m. the alert is a single line of text, and the person on call has to decide in a minute whether to wake somebody. Everything needed for that decision is in the line, if you know which four things to look for.
How to think about it
Read a line in the same order every time: time, source, action, result. Say it out loud as a sentence. If you cannot, one of the four is missing, and a log that cannot answer all four is a log that will not answer the question you ask it in March.
Worked example
2026-03-04 02:14:07 sshd: failed password for admin from 203.0.113.24One line. Four answers in it.
When: 2026-03-04 02:14:07In UTC if you can, so lines from different machines can be laid side by side.
Where from: 203.0.113.24An address outside your own ranges deserves a second look.
What and whether: a password attempt on the admin account, and it failedSaid as a sentence: at 02:14:07 an outside address tried the admin password and did not get in.
Your turn
Write the name of the field that says whether what was attempted actually worked.
field: the
Solve one, graded on the server
The trap
Reading the action and skipping the result. 'Password for admin from 203.0.113.24' is a completely different morning depending on whether the next word is failed or accepted.