I built a log analyzer, and it found real attacks on my own machine

I am documenting every day of my cybersecurity learning journey publicly. This post covers Days 8 through 12 — the first half of Week 2. The log analyzer and what it found The most significant thing I built this week is a Python log analyzer. It reads Linux auth.log files, finds every failed SSH login attempt, extracts the source IP from each one, and counts how many times each IP tried. Here is the core logic: from collections import Counter failed_ips = [] with open ( " /var/log/auth.log " , "