Reading logs for a story

By default awk splits each line on runs of whitespace and numbers the pieces starting at one. In a log line the timestamp is field one, the user is field two and the result is field four, so asking for those three prints a clean summary. It reads every line of the file, not just the first few, and it does not change the file.

uniq compares each line with the one before it, so it counts a run of identical lines and nothing else. If the same value appears in two separate places, uniq reports two runs of one. Sorting first brings the copies together so there is a single run to count, which is why the two commands are almost always used as a pair.

In ISO 8601 the largest unit comes first, year then month then day then time, so a line-by-line text sort and a chronological sort give the same order. That is what lets a plain sort build a timeline. It is not shorter than other formats, and it does not hide the zone, because the Z or the offset is part of it.

Many failures and then a success is the shape a guessed password makes, but a broken script or a stale saved password looks the same. The log tells you what happened, not why. Use it to ask a sharp question, then check the account itself, and act once you know rather than guessing in either direction.