performance
hard
Apply
log-pipeline
2 points
Question 19. CSCD240-E1-B
Top 5 source IPs in FAIL lines of auth.log, where IP is field 5.
Work the drill
Answer on paper or in a terminal before revealing the ideal answer.
Ideal answer
grep FAIL auth.log | awk '{print $5}' | sort | uniq -c | sort -rn | head -5
Acceptable alternatives: ["grep FAIL auth.log | cut -d ' ' -f 5 | sort | uniq -c | sort -rn | head -5"]
Misconception bank
Each row below is a plausible wrong answer, the thinking that produces it, and the remedy that corrects the misconception. These are the foundation of the multiple-choice framing and the targeted feedback a student receives after answering.
awk '{print $5}' auth.log | sort | uniq -c | sort -rn | head -5
Misconception. Missing FAIL filter.
Remedy. Filter FIRST, then aggregate.
grep FAIL auth.log | awk '{print $5}' | sort -rn | head -5
Misconception. Skipped uniq -c; returns 5 unique IPs in alphabetical order.
Remedy. Teach the 5-stage idiom.
Authority mappings
Hover any chip for the mapping justification; click to open the authority record.
KU topics:
CD-OSC-T5
NCAE errors:
WWW Content / failure: Failed to connect to hostWWW Content / timeout: TimeoutWWW Content / failure: Website cannot be reachedSSH Login / failure: Failed to connect to host: IPSSH Login / partial: The following users failed t.SSH Login / partial: The following users failed t.
Course-artifact links
Lectures
- CSCD240-S26-L08. Pipes, filters, grep, sort, uniq, wc, tar
Lab questions
- CSCD240-S26-LAB4: Build pipeline: sort words.txt | uniq -c | sort -rn | head. Top-N frequency.