220-1102 Question 242
Single answergrepA Linux technician is troubleshooting repeated failed SSH login attempts on a workstation. The technician needs to quickly display only the lines in /var/log/auth.log that contain the exact text "Failed password" so they can review the relevant events. Which command should the technician use?
- A
grep "Failed password" /var/log/auth.log
- B
grep /var/log/auth.log "Failed password"
- C
cat /var/log/auth.log | grep -v "Failed password"
- D
find "Failed password" /var/log/auth.log
Show answer and explanation
Correct answer: A
Explanation
This question tests practical use of grep in a real troubleshooting scenario. In Linux, grep is commonly used to search log files for specific events, such as authentication failures. The basic syntax is grep "pattern" filename. This makes it a standard tool for reviewing logs like /var/log/auth.log during security or access-related investigations. By contrast, grep -v excludes matching lines, and find searches for filesystem objects rather than text inside files. This aligns with common Linux command-line usage documented in grep manual pages (man grep) and standard administrative best practices for log review.
- A. Correct.
Correct. The grep command searches a file for matching text patterns. Using grep "Failed password" /var/log/auth.log displays only the lines in that log file that contain the specified phrase, which is exactly what the technician needs for targeted troubleshooting.
- B. Incorrect.
Incorrect. This reverses the normal grep syntax. grep expects the search pattern first and then the file name. Entering the file path before the search string would cause the command to be interpreted incorrectly and would not return the desired results.
- C. Incorrect.
Incorrect. The -v option tells grep to invert the match, meaning it shows lines that do NOT contain "Failed password." A technician might choose this if they confuse filtering with exclusion, but it would hide the failed login entries instead of displaying them.
- D. Incorrect.
Incorrect. The find command is used to locate files and directories, not search within file contents for text strings. This is a common misconception for those who confuse file searching with content searching.