Linux host logs

Quick pivots for systemd journal and common Linux authentication logs.

Recent service logs

Replace sshd with the service you are investigating.

journalctl -u sshd --since "1 hour ago"

Failed SSH logons with journalctl

journalctl -u ssh --since today | grep "Failed password"

Current logons

who

Recent login history

last -a

Processes with listening sockets

ss -lntup

Recently modified files under /etc

find /etc -type f -mtime -1 -print