Logs and scheduled tasks: journalctl, cron, at
journalctl, syslog, cron, systemd timers and backups.
Level 201 · 15 lessons · 12 practice labs
Lessons
Logs
- Where logs live: syslog and auth.log: You will learn where Linux keeps its logs, what syslog and auth.log record, and which one to check for which kind of event.
- Filtering with journalctl: unit, priority and time range
- Searching and filtering logs: You will use grep and similar tools to find a given user, time or error message in large log files and narrow down the results.
- Watching logs live: You will learn to watch new log entries as they arrive, and to see a system's reaction live during a change or a fault.
- Log rotation and retention: logrotate: With logrotate you can stop logs from filling the disk and set retention time and compression.
- Short task: why did the server reboot last night?
Scheduled jobs
- cron: syntax and time fields: You will understand how cron runs scheduled jobs, how to read its five time fields, and how to write your own schedule line correctly.
- User crontabs and system cron directories: You will learn the difference between a user's crontab and the system-wide cron directories, and where each kind of job belongs.
- cron pitfalls: absolute paths and capturing output: You will learn why cron jobs can fail silently, and how using absolute paths and capturing output to a file prevents that.
- One-time jobs with at: You will use at to schedule a job to run once at a later time, and to list and cancel pending jobs.
- anacron: jobs missed while the machine was off
- cron.allow, cron.deny and who may schedule jobs
- Short task: a nightly job that clears old temp files and keeps a record
Investigating an incident
- Building an incident timeline from logs: You will learn to put entries from different logs into time order and build a timeline showing how an incident began and progressed.
- Capstone: maintenance automation and an incident report: For a fictional company's lab server you will set up scheduled maintenance jobs, investigate a problem in the logs, and gather your findings in a short incident report.
Practice labs
- Filter a time range in the journal: Show the error-level entries between midnight and six yesterday morning and submit the count.
- Count failed logins by source: Extract failed SSH logins from the authentication log and list the three addresses with the most attempts.
- Write a rotation rule for a log filling the disk: Write a daily, compressed, fourteen-copy rule for an application log that never rotates and verify it with a debug run.
- Add a first scheduled job: Add a disk report job that runs daily at 06:30 to the user crontab and redirect its output to a file.
- Fix a job that works by hand but not from cron: Find and fix the PATH and working directory difference in a script that runs in a terminal but fails when scheduled.
- Move a cron job to a systemd timer: Convert a cron job with overlapping runs into a timer that never overlaps and catches up on missed runs.
- Extract who logged in and when: From the login records list the accounts that connected in the last three days with times and source addresses.
- Trace privileged commands: Find from the logs the sudo command that stopped a service at a given hour, the user who ran it and the address they came from.
- Build the timeline of a night outage: Combine login, sudo, service and scheduled job records into a minute-by-minute timeline and cause of the outage at Turnalı Perakende.
- Schedule a one-off job for later: Schedule a restart command to run once in the maintenance window, list the queue and show how to cancel it.
- Inventory every scheduled job on the server: Scan user crontabs, system cron directories and timers and gather them in one list with owner and command.
- Find and assess an unrecognised scheduled job: Find a scheduled job missing from the inventory that runs a world-writable script, determine when it was added, disable it and report.
About this course
journalctl, syslog, cron, systemd timers and backups.
What you will learn
- Logs
- Scheduled jobs
- Investigating an incident
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.