An administrator is writing a Bash script to audit SSH logins. Which of the following logs would the administrator parse to find the needed information?

The correct answer is A. /var/log/secure/. On Red Hat Enterprise Linux (RHEL), CentOS, and related distributions, SSH authentication events - including successful logins, failed attempts, and session openings - are written to /var/log/secure. This is the correct log to parse for SSH auditing. /var/log/messages contains…

Security

Question

Options

A/var/log/secure/
B/var/log/messages
C/var/log/firewalld
D/var/log/sssd

How the community answered

(45 responses)

A
93% (42)
B
2% (1)
D
4% (2)

Explanation

On Red Hat Enterprise Linux (RHEL), CentOS, and related distributions, SSH authentication events - including successful logins, failed attempts, and session openings - are written to /var/log/secure. This is the correct log to parse for SSH auditing. /var/log/messages contains general kernel and system messages but not authentication detail. /var/log/firewalld logs firewall rule activity. /var/log/sssd logs System Security Services Daemon activity related to centralized identity management (e.g., LDAP/Active Directory), not direct SSH logins. Note: on Debian/Ubuntu systems, the equivalent file is /var/log/auth.log, but for CompTIA Linux+ exam purposes, /var/log/secure is the expected answer.

Topics

#SSH logs#secure log#audit logging#/var/log/secure

Community Discussion

No community discussion yet for this question.

Full XK0-004 Practice