auth.log: reading sshd login lines
When someone asks "did anyone get in?", the answer is in the sshd lines of auth.log (Debian, Ubuntu) or /var/log/secure (the RHEL family). The lines are short and regular, which makes them easy to count — once you know exactly what sshd writes and what it leaves out.
Drop the file on this page and the board shows failed logins by IP and by user, invalid usernames, brute-force sources, and the one that matters most: a login that succeeded right after repeated failures. The one-liners below answer the same questions on the server.
What sshd writes
Each line has the syslog header (time, host, sshd[pid]:) and a message. The authentication messages come from two places in OpenSSH, with these shapes:
<Accepted|Failed|Partial|Postponed> <method>[/<submethod>] for [invalid user ]<user> from <address> port <port> ssh2[: <key type and fingerprint>]
Invalid user <user> from <address> port <port>Real lines:
Oct 18 03:12:01 web-1 sshd[3011]: Invalid user admin from 203.0.113.66 port 41022
Oct 18 03:12:03 web-1 sshd[3011]: Failed password for invalid user admin from 203.0.113.66 port 41022 ssh2
Oct 18 03:12:05 web-1 sshd[3015]: Failed password for root from 203.0.113.66 port 41030 ssh2
Oct 18 04:01:21 web-1 sshd[3190]: Accepted password for deploy from 192.0.2.50 port 60110 ssh2
Oct 18 09:15:42 web-2 sshd[1844]: Accepted publickey for deploy from 10.0.0.5 port 50122 ssh2: ED25519 SHA256:3q8b…| Word | Meaning |
|---|---|
Accepted | Authentication succeeded with this method. This is a login. |
Failed | This attempt failed. |
Partial | This method succeeded, but more are required (for example key and then a one-time code). |
Postponed | The method needs another round trip before a decision. |
Invalid user | The user name does not exist on this host. The following Failed … for invalid user … line is the attempt itself. |
password, publickey, keyboard-interactive | The method. For publickey, the key type and fingerprint follow after "ssh2:". |
ssh2 | Protocol 2. Always this on current OpenSSH. |
Why some failures are not in the file
sshd logs authentication results at VERBOSE level and raises them to INFO only when the login succeeded, the user is invalid, the method is password, or the failures reached half of MaxAuthTries. With the usual LogLevel INFO, a valid user's single failed public key attempt — a client offering the wrong key first — does not appear. So "no Failed publickey lines" does not mean no key was rejected. Set LogLevel VERBOSE if you need them.
Patterns worth recognising
| Pattern | What it looks like | What it usually is |
|---|---|---|
| Brute force | Many Failed lines from one address against one or two users. | A bot trying passwords for root or a common account. |
| User enumeration / spraying | One address, many Invalid user names (admin, test, oracle, ubuntu…). | A scanner trying default accounts. |
| Distributed guessing | One user name, Failed from many addresses, few attempts each. | A botnet staying under per-address limits. |
| Success after failures | Failed lines from an address, then Accepted from the same address. | Either a person mistyping a password, or a guess that worked. Check which, every time. |
| Accepted from an unexpected place | Accepted for a real user from an address outside the usual ranges, or at an unusual hour. | Stolen credentials or key, or a colleague on a new network. Verify. |
The success-after-failures check is the one to run first in an incident. The one-liner below prints every address that logged in after failing, with the number of failures.
Shell one-liners for auth.log
Run against a sample auth.log with the classic syslog header. On systems where sshd only writes to the journal, pipe journalctl -u ssh (Debian, Ubuntu) or journalctl -u sshd (RHEL family) into the same commands instead of reading the file.
Failed password attempts per source address.
grep 'Failed password' auth.log | grep -oE 'from [0-9a-f.:]+' | cut -d' ' -f2 | sort | uniq -c | sort -rn | headFailed attempts per user name, including invalid ones.
grep -oE 'Failed [a-z-]+ for (invalid user )?[^ ]+' auth.log | awk '{print $NF}' | sort | uniq -c | sort -rn | headUser names that do not exist here but were tried.
grep -oE 'Invalid user [^ ]+' auth.log | cut -d' ' -f3 | sort | uniq -c | sort -rn | headEvery successful login: time, method, user, address.
grep 'Accepted ' auth.log | awk '{print $1, $2, $3, $7, $9, $11}'Accepted and Failed per authentication method.
grep -oE '(Accepted|Failed) [a-z-]+' auth.log | sort | uniq -c | sort -rnAddresses that logged in after failing — check each one.
awk '/Failed /{for (i = 1; i < NF; i++) if ($i == "from") f[$(i+1)]++} /Accepted /{for (i = 1; i < NF; i++) if ($i == "from" && f[$(i+1)]) print $(i+1), "accepted after", f[$(i+1)], "failures"}' auth.logFailed password attempts per hour.
grep 'Failed password' auth.log | cut -c1-9 | uniq -cFailed password attempts for root.
grep -c 'Failed password for root ' auth.logHow many distinct addresses failed a password.
grep 'Failed password' auth.log | grep -oE 'from [0-9a-f.:]+' | sort -u | wc -lLines per host, when several servers log to one file.
awk '{print $4}' auth.log | sort | uniq -c | sort -rn
FAQ
Where is the SSH login log?
/var/log/auth.log on Debian and Ubuntu, /var/log/secure on RHEL, CentOS, Rocky and Alma. On hosts that only use the systemd journal, read it with journalctl for the ssh or sshd unit.
What is the difference between "Invalid user" and "Failed password for invalid user"?
Invalid user is logged when the name is looked up and does not exist; every authentication attempt for that name then gets its own Failed … for invalid user line. Count Failed lines for attempts and Invalid user lines for names tried; adding the two together double counts.
Why are there no "Failed publickey" lines?
At the default log level, sshd only reports a failed key attempt for a valid user once failures reach half of MaxAuthTries. A client trying several keys is normal and stays quiet. Use LogLevel VERBOSE to see them.
How do I tell if a brute-force attack succeeded?
Look for an Accepted line from an address that also has Failed lines. The "addresses that logged in after failing" one-liner lists them with the failure count.
Does the log show which key was used?
Yes, for Accepted publickey lines: the key type and its SHA256 fingerprint follow "ssh2:". Match the fingerprint against authorized_keys with ssh-keygen -lf.
Is it safe to paste auth.log into an online tool?
It contains user names, source addresses and login times. On this page nothing leaves the browser — the page is blocked from sending data by its Content-Security-Policy.