Log Analysis Fundamentals

A log answers three questions, increasingly hard: what happened, what else happened around it (correlation), is this normal (baseline). Beginners do the first. Analysts are paid for the other two.

10.2.3.4 - - [21/Jul/2026:04:12:09] "GET /admin" 403 "curl/8.4"
10.2.3.4 - - [21/Jul/2026:04:12:09] "GET /.env" 404 "curl/8.4"
10.2.3.4 - - [21/Jul/2026:04:12:10] "GET /backup.zip" 404 "curl/8.4"

Three requests, one second, no referrer, scripted UA, sensitive paths, all failing. That's content discovery, not a user. The tell is never one line — it's rate + pattern + absence of human context.

The core idiom: sort | uniq -c | sort -rn turns text into a ranked frequency table, and frequency is where anomalies live.

Beaconing — malware calls home on a schedule; humans don't. Near-constant intervals with low variance are suspicious regardless of whether the domain is known-bad. Compute deltas between connections to the same destination.

Note: the attacker is often not the top talker by raw volume. Rank by error rate and user-agent anomaly instead.