67 lines
2.3 KiB
EmacsLisp
67 lines
2.3 KiB
EmacsLisp
;;; 80-log-filtering-lesson.el --- log-filtering-lesson
|
|
|
|
(defun log-filtering-lesson ()
|
|
"Linux+ lesson for log filtering and grep chaining."
|
|
(interactive)
|
|
(delete-other-windows)
|
|
(let ((buf (get-buffer-create "*Log Filtering Lesson*"))
|
|
(shell (or shell-file-name (getenv "SHELL") "/bin/sh")))
|
|
(switch-to-buffer buf)
|
|
(read-only-mode -1)
|
|
(erase-buffer)
|
|
(insert
|
|
"Linux+ Lesson: Log Filtering and grep Chaining\n"
|
|
"==============================================\n\n"
|
|
"Concepts:\n"
|
|
"- grep searches for patterns\n"
|
|
"- pipes combine filters\n"
|
|
"- chaining grep narrows results\n"
|
|
"- logs contain noise and useful signals\n\n"
|
|
"VERY IMPORTANT:\n"
|
|
"This is WRONG:\n\n"
|
|
" grep ssh fail logfile\n\n"
|
|
"Why?\n"
|
|
"- grep expects ONE pattern\n"
|
|
"- 'fail' becomes a filename\n\n"
|
|
"Correct approaches:\n\n"
|
|
" grep ssh logfile | grep fail\n\n"
|
|
"or:\n\n"
|
|
" grep 'ssh.*fail\\|fail.*ssh' logfile\n\n"
|
|
"Hands-on tasks:\n\n"
|
|
"1. View recent journal entries:\n"
|
|
" journalctl | head\n\n"
|
|
"2. Search for ssh activity:\n"
|
|
" journalctl | grep -i ssh\n\n"
|
|
"3. Search for failures:\n"
|
|
" journalctl | grep -i fail\n\n"
|
|
"4. Chain filters together:\n"
|
|
" journalctl | grep -i ssh | grep -i fail\n\n"
|
|
"5. Search for invalid users:\n"
|
|
" journalctl | grep -i invalid\n\n"
|
|
"6. Search for authentication issues:\n"
|
|
" journalctl | grep -i denied\n\n"
|
|
"7. Compare broad vs narrow filtering:\n"
|
|
" journalctl | grep -i ssh\n"
|
|
" journalctl | grep -i ssh | grep -i fail\n\n"
|
|
"What to notice:\n"
|
|
"- first command = noise\n"
|
|
"- second command = signal\n"
|
|
"- chained grep reduces output size\n\n"
|
|
"Linux+ exam traps:\n"
|
|
"- grep takes ONE pattern unless combined explicitly\n"
|
|
"- grep chaining is very common\n"
|
|
"- logs are often filtered progressively\n\n"
|
|
"When finished, run:\n"
|
|
" M-x log-filtering-quiz\n")
|
|
(goto-char (point-min))
|
|
(view-mode 1)
|
|
(split-window-below)
|
|
(other-window 1)
|
|
(let ((term (get-buffer "*term*")))
|
|
(if (buffer-live-p term)
|
|
(switch-to-buffer term)
|
|
(ansi-term shell "term")))
|
|
(other-window -1)))
|
|
|
|
;;; 80-log-filtering-lesson.el ends here
|