performance hard Apply log-pipeline 2 points

Question 20. CSCD240-E1-B

Count distinct usernames on FAIL lines of auth.log where username is "user=<name>".

Work the drill

Answer on paper or in a terminal before revealing the ideal answer.

Ideal answer

grep FAIL auth.log | grep -o 'user=[a-zA-Z0-9]*' | sort -u | wc -l

Acceptable alternatives: ["grep FAIL auth.log | awk '{print $(NF-1)}' | cut -d= -f2 | sort -u | wc -l", "awk '/FAIL/{print $4}' auth.log | cut -d= -f2 | sort -u | wc -l"]

Misconception bank

Each row below is a plausible wrong answer, the thinking that produces it, and the remedy that corrects the misconception. These are the foundation of the multiple-choice framing and the targeted feedback a student receives after answering.

grep FAIL auth.log | sort -u | wc -l

Misconception. Dedupes whole lines, not usernames.

Remedy. Extract the username field first.

grep FAIL auth.log | uniq | wc -l

Misconception. Missing sort before uniq.

Remedy. Golden rule: sort before uniq.

Authority mappings

Hover any chip for the mapping justification; click to open the authority record.

DCWF roles: EN-211 Forensics Analyst CS-511 Cyber Defense Analyst

DCWF tasks: T0447

KU outcomes: CO-M9-O1

O*NET tasks: SOC 15-1212.00: task 6 SOC 15-1212.00: task 7

NCAE errors: WWW Content / failure: Failed to connect to hostWWW Content / timeout: TimeoutWWW Content / failure: Website cannot be reachedSSH Login / failure: Failed to connect to host: IPSSH Login / partial: The following users failed t.SSH Login / partial: The following users failed t.

Course-artifact links

Lectures

CSCD240-S26-L08. Pipes, filters, grep, sort, uniq, wc, tar

Lab questions

CSCD240-S26-LAB4: Build pipeline: sort words.txt | uniq -c | sort -rn | head. Top-N frequency.