The Linux sort Command Is Not for Alphabetizing: A SOC Analyst’s Guide to Log Triage

Most Linux tutorials teach the sort command with a grocery list. Then a real incident hands you tens of thousands of auth log lines and one question: which IPs are hammering this server?

That is where sort becomes a triage tool. Paired with uniq, one line does the heavy lifting:

sort | uniq -c | sort -nr

The first sort groups identical lines, uniq -c counts each group, and the second sort ranks them highest first. Point it at a filtered SSH log and the noisiest source IPs rise to the top.

Inside the full guide (20+ examples):

• -n, -h, and -V for numbers, file sizes, and IPs
• -k and -t for column and CSV sorting
• Ranking failed SSH logins and busy web clients
• Threat-intel matching with comm
• Two classic mistakes that trip up experienced admins

One caveat: a high count shows what stands out, not what is malicious. Correlate with successful logins, harden SSH, and centralize logs in a SIEM.

Full guide with commands, expected output, and expert tips: https://www.xpert4cyber.com/2026/09/linux-sort-command-guide.html