Linux15: Sizing Up the Attack

Security logs can run into millions of lines — you need to know the shape of the data before diving in

Objective

Learner can count records and inspect earliest and latest entries of a large file efficiently

Mission

~/cases/case-1042/evidence/access-events.log is massive. Before escalating, Sarah wants three quick facts: total event count, the earliest event timestamp, and the latest event timestamp

Commands you may need to solve this lab

wc -lheadtail

Questions

1. Which command counts the total number of lines in a file?

2. Which commands show the beginning and end of a file without opening the full file?

3. Why is opening a multi-gigabyte log file in a standard GUI editor inefficient or risky?

Machine Offline

Isolated container is offline

Click "Start Machine" to boot your sandbox instance and choose your preferred interface