Rotated Evidence: the Break-in Hiding in a Compressed Log

An analyst ran grep 'Failed password' /var/log/auth.log, saw a few benign internal typos, and closed the ticket. The host was compromised anyway.

The reason is rotation. Text logs don't grow forever — logrotate rolls auth.log over and gzip-compresses the older generations, so /var/log holds a mixed set: auth.log (live), auth.log.1 (rotated, plain), and auth.log.2.gz, auth.log.3.gz, auth.log.4.gz (compressed). A plain grep on the live file reads only the newest slice — and the break-in has already rotated into a .gz.

Search the whole set — zgrep 'pattern' /var/log/auth.log* reads plain and compressed generations in one pass — and record three findings:

1. /root/case/failed_count.txt — total number of Failed password events across the entire rotated set.

2. /root/case/attacker_ip.txt — the external source IP behind the brute-force (many failures; it appears only in a compressed generation).

3. /root/case/compromised_user.txt — the account whose login was finally Accepted from that IP.

A silent, empty single-file result is the trap, not the answer. zgrep/zcat/zless — or a gunzip -c loop — are all you need.