Reading the Tea Leaves: Hunting Intruders with journalctl and lnav

Tue, 02 Jun 2026 10:00:00 +0000

When you suspect something is wrong with a server — a sluggish response, an odd process, a vague unease — the temptation is to start poking at running state. But the running state is the present, and an intruder’s interesting work is usually in the past. The record of that past is sitting right there in your logs, already written, already timestamped. Logs are your first and cheapest forensic tool, and two utilities turn them from an overwhelming wall of text into a readable story: journalctl and lnav.

Forensics - Tag - vo.rs

Reading the Tea Leaves: Hunting Intruders with journalctl and lnav