During an investigation, a SOC analyst needs to reconstruct which user account authenticated to a Linux server, at what time, and whether the login succeeded or failed. The analyst is deciding which data source will most directly provide this specific record. Which data type should the analyst consult first?