• If you find a log, use head log to see it:

  • This log indicates that someone tried a brute force attack via ssh
    • So what if a user logged in between? Weโ€™ve got his/her password
  • Do a grep like: cat log | grep USER