auth.log & Failed Login Hunt

Investigate failed logins with auth.log/journalctl on a synthetic lab log — identify the noisy source.

This room unlocks when you enrol in a linked course or have a matching Learn plan. No separate lab checkout — practice stays inside the track.