Safe log reading

Cybersecurity Foundations (Grades 6–8) · lesson 41 of 48 · 8 min

Logs: The Black Box of Your Digital World

Every significant event on a computer system is recorded in a log. Logins, file accesses, network connections, errors, and configuration changes — all of it leaves a trace. Logs are the primary source of evidence in security investigations, and the ability to read them is one of the most practical skills in cybersecurity.

Security analysts, incident responders, and forensic investigators spend a significant part of their work reading logs. This lesson teaches you to read common log formats, identify suspicious patterns, and understand what logs can and cannot tell you.

By the end of this lesson you will be able to read a basic log entry, identify suspicious patterns like brute-force attacks and impossible travel, explain why UTC timestamps matter, and understand what log gaps might indicate.

Logs are everywhere

Your computer generates logs for every login attempt, every application crash, every network connection, and every USB device plugged in. Your router logs every DNS query and connection. Your school’s network logs every website you visit. Logs are the foundation of security monitoring — and attackers know this, which is why deleting logs is often one of the first things they do after gaining access.

Common Log Types

Reading a Log Entry

Most log entries follow a similar structure. Here is an example authentication log entry:

Example log entry

Reading this entry: On 14 October 2026 at 14:32 UTC, there were 47 failed login attempts for the “admin” account via SSH from IP address 203.0.113.42. This is a classic brute-force attack pattern.

Suspicious Patterns to Look For

Knowledge Check

A log shows 200 failed SSH login attempts for the “root” account from a single IP in 60 seconds. What does this indicate?

A user forgot their password
A brute-force attack targeting the root account
A software bug causing repeated login attempts
Normal network activity

Answer: A brute-force attack targeting the root account
200 failed attempts in 60 seconds from one IP is a classic brute-force pattern. The root account is targeted because it has full system access.

Why are log timestamps recorded in UTC rather than local time?

UTC is more accurate than local time
To avoid confusion when correlating logs from systems in different timezones
Because UTC is required by law
Local time is not supported by logging software

Answer: To avoid confusion when correlating logs from systems in different timezones
When building a timeline from logs across multiple systems and locations, a common timezone (UTC) ensures timestamps can be accurately correlated.

What does a gap in log entries potentially indicate?

The system was idle
An attacker deleted logs to cover their tracks
The logging software was updated
Nothing — gaps are normal

Answer: An attacker deleted logs to cover their tracks
Attackers often delete or modify logs to hide their activity. Unexplained gaps in log continuity are a red flag that should be investigated.

DNS logs can be used to detect malware communicating with a command-and-control server.

True
False

Answer: True
Malware often uses DNS to communicate with attacker-controlled servers. DNS logs show every domain lookup, making unusual or malicious domains visible.

A user logging in from New York and then London 10 minutes later is an example of _____ travel — a sign of account compromise.

Answer: impossible
Impossible travel detects when login locations are physically impossible given the time between them — a strong indicator of stolen credentials.

Real-World Case Studies

Case 1: The Marriott Breach — 4 Years Undetected in Logs

In 2018, Marriott disclosed that attackers had been inside the Starwood hotel reservation system since 2014 — four years. The breach exposed 500 million guest records. Forensic investigators found that the attackers had been present in logs the entire time, but the logs had not been monitored effectively. The lesson: logs are only useful if someone reads them. Unmonitored logs are the equivalent of a security camera that no one watches.

Case 2: Detecting the Insider Threat Through Log Analysis

In 2020, a Tesla employee was approached by a Russian national who offered $1 million to install malware on Tesla’s network. The employee reported the approach to the FBI. The FBI set up a sting operation — and log analysis of the employee’s network activity was used to confirm they had not already been compromised. Log analysis is used not just to detect external attackers but also to investigate insider threats and exonerate innocent employees.

Previous lesson: Evidence and timelines
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: Digital footprint investigation