Linux Log Analysis

• /var/log/syslog – general system events
• /var/log/auth.log – authentication attempts
• /var/log/messages – kernel and system messages
• ~/.bash_history – command history of users

grep "Accepted password" /var/log/auth.log

grep "CTF{" /var/log/*