Lessons · Cybersecurity · reading a log line
One log line, four questions
Every useful log line answers when it happened, where it came from, what was attempted, and whether it worked.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
In beta. This lesson was written for Hone and has not yet been checked by a practising security analyst. Practice material, not professional advice. What that means.
What it is for
At 3 a.m. the alert is a single line of text, and the person on call has to decide in a minute whether to wake somebody. Everything needed for that decision is in the line, if you know which four things to look for.
How to think about it
Read a line in the same order every time: time, source, action, result. Say it out loud as a sentence. If you cannot, one of the four is missing, and a log that cannot answer all four is a log that will not answer the question you ask it in March.
Worked example
2026-03-04 02:14:07 sshd: failed password for admin from 203.0.113.24One line. Four answers in it.
When: 2026-03-04 02:14:07In UTC if you can, so lines from different machines can be laid side by side.
Where from: 203.0.113.24An address outside your own ranges deserves a second look.
What and whether: a password attempt on the admin account, and it failedSaid as a sentence: at 02:14:07 an outside address tried the admin password and did not get in.
Your turn
Write the name of the field that says whether what was attempted actually worked.
field: the
Solve one, graded on the server
The trap
Reading the action and skipping the result. 'Password for admin from 203.0.113.24' is a completely different morning depending on whether the next word is failed or accepted.