;;; 80-log-filtering-lesson.el --- log-filtering-lesson

(defun log-filtering-lesson ()
  "Linux+ lesson for log filtering and grep chaining."
  (interactive)
  (delete-other-windows)
  (let ((buf (get-buffer-create "*Log Filtering Lesson*"))
        (shell (or shell-file-name (getenv "SHELL") "/bin/sh")))
    (switch-to-buffer buf)
    (read-only-mode -1)
    (erase-buffer)
    (insert
     "Linux+ Lesson: Log Filtering and grep Chaining\n"
     "==============================================\n\n"
     "Concepts:\n"
     "- grep searches for patterns\n"
     "- pipes combine filters\n"
     "- chaining grep narrows results\n"
     "- logs contain noise and useful signals\n\n"
     "VERY IMPORTANT:\n"
     "This is WRONG:\n\n"
     "  grep ssh fail logfile\n\n"
     "Why?\n"
     "- grep expects ONE pattern\n"
     "- 'fail' becomes a filename\n\n"
     "Correct approaches:\n\n"
     "  grep ssh logfile | grep fail\n\n"
     "or:\n\n"
     "  grep 'ssh.*fail\\|fail.*ssh' logfile\n\n"
     "Hands-on tasks:\n\n"
     "1. View recent journal entries:\n"
     "     journalctl | head\n\n"
     "2. Search for ssh activity:\n"
     "     journalctl | grep -i ssh\n\n"
     "3. Search for failures:\n"
     "     journalctl | grep -i fail\n\n"
     "4. Chain filters together:\n"
     "     journalctl | grep -i ssh | grep -i fail\n\n"
     "5. Search for invalid users:\n"
     "     journalctl | grep -i invalid\n\n"
     "6. Search for authentication issues:\n"
     "     journalctl | grep -i denied\n\n"
     "7. Compare broad vs narrow filtering:\n"
     "     journalctl | grep -i ssh\n"
     "     journalctl | grep -i ssh | grep -i fail\n\n"
     "What to notice:\n"
     "- first command = noise\n"
     "- second command = signal\n"
     "- chained grep reduces output size\n\n"
     "Linux+ exam traps:\n"
     "- grep takes ONE pattern unless combined explicitly\n"
     "- grep chaining is very common\n"
     "- logs are often filtered progressively\n\n"
     "When finished, run:\n"
     "  M-x log-filtering-quiz\n")
    (goto-char (point-min))
    (view-mode 1)
    (split-window-below)
    (other-window 1)
    (let ((term (get-buffer "*term*")))
      (if (buffer-live-p term)
          (switch-to-buffer term)
        (ansi-term shell "term")))
    (other-window -1)))

;;; 80-log-filtering-lesson.el ends here