SSH events are recorded either in a traditional authentication log—often /var/log/auth.log—or in the systemd journal. Start by identifying which store and service unit your host uses, then examine timestamps, result text, account names, source addresses, authentication methods and session records. A burst of failures indicates probing or brute-force activity, but it does not prove that anyone entered the machine; an accepted login and its follow-on activity require separate verification.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Find where this host records SSH activity
Do not assume that every Linux server has the same file or service name. Distribution logging choices, package defaults and local configuration determine whether sshd messages are written to a flat file, the systemd journal, or both. Establish the source before searching for patterns.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Traditional authentication logs
On many syslog-oriented systems, failed and accepted SSH authentications are written to /var/log/auth.log. Other distributions use a different authentication-log path. A missing /var/log/auth.log therefore does not mean that SSH generated no records.
sudo grep -E 'Failed password|Invalid user|authentication failure|Accepted ' /var/log/auth.logRead the original lines before filtering them. The unmodified entry preserves the host name, timezone context, process name and wording that later commands may discard.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
systemd journal
On a systemd host, query the SSH service unit directly. The daemon may be registered as ssh.service or sshd.service; the names are not interchangeable.
sudo journalctl -u ssh --since "24 hours ago" --output short-iso
sudo journalctl -u sshd --since "24 hours ago" --output short-isoThe -u option selects a unit, --since limits the beginning of the time range, and --output short-iso gives RFC 3339-style timestamps that are easier to compare across systems. If one command reports that the unit does not exist, try the other and verify the service name rather than concluding that no SSH events are present.
For a live investigation, follow the active unit:
sudo journalctl -f -u ssh
# or, on systems where the daemon is named sshd:
sudo journalctl -f -u sshd-f continuously prints new entries until you interrupt it. A live view is useful while reproducing a known login or watching whether a suspected source continues to connect.
Understand the fields in an SSH record
Capture the complete line for every event that matters. At minimum, record:
- Timestamp: include the timezone or the journal’s normalized timestamp.
- Daemon and process: identify sshd and, where shown, its process identifier.
- Result wording: such as
Failed password,Invalid user,authentication failureorAccepted. - Account: the username supplied or accepted.
- Source: the remote address and, if present, source port or hostname.
- Phase: a
preauthmarker indicates that the connection failed before authentication completed. - Method: password, public key, keyboard-interactive, GSSAPI or host-based authentication where the record states it.
Repeated failures from one address within a short interval are more suspicious than isolated failures spread across unrelated addresses. Repeated attempts against many account names, a regular cadence, or activity that continues for hours strengthens the case for automated probing. None of those characteristics alone establishes that the host was compromised.
Recognize failed SSH attempts without overstating them
“Failed password”
This wording means that a password authentication attempt did not succeed. It is evidence of an unsuccessful attempt, not evidence of a successful one later or earlier in the same connection.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsRank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
“Invalid user”
An invalid-user event means that the supplied account name was not recognized as a valid login identity at that point. A sequence cycling through names such as service accounts, personal names and common administrative accounts is typical of username discovery or a password-guessing script, but the line still represents a failed authentication.
“Authentication failure” and other variants
PAM modules and distribution-specific logging can use broader wording. Preserve the surrounding context and inspect the complete entry instead of building an interpretation from one phrase. A single generic failure may be a mistyped password by a legitimate operator; a concentrated sequence sharing an address, timing pattern and target accounts deserves investigation.
Count activity carefully
A quick count can reveal the busiest source, but message formats differ. This example is useful only after inspecting representative lines:
sudo grep -E 'Failed password|Invalid user|authentication failure' /var/log/auth.log
| awk '{print $(NF-5)}' | sort | uniq -c | sort -nr | headThe awk field position is not universal. Hostnames, ports, IPv6 addresses and wording changes can move the address to another field. Treat the output as a lead, not as authoritative parsing. Fail2Ban filters are designed to match authentication failures and extract a host address, so use a maintained filter rather than assuming one column number works on every distribution.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Distinguish probing from an accepted session
Search the same time window for an Accepted record. It identifies an authentication that sshd accepted and normally states the account, source address and method. Correlate those values with the failures before and after it.
sudo grep -E 'Accepted |Failed password|Invalid user|authentication failure' /var/log/auth.logAn address that generated hundreds of failures and then produced an accepted event is a high-priority lead, but the accepted line alone does not prove malicious access. Compare the account with the person or service expected to log in, check whether the source belongs to an approved network, and examine what happened after the session opened.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Authentication methods that password searches miss
OpenSSH supports password, public-key, keyboard-interactive, GSSAPI and host-based authentication. A search for Failed password therefore covers only one method. Key-based attempts can fail or succeed without producing a password-failure line, and keyboard-interactive authentication may be mediated by PAM or a multi-factor system.
For public-key authentication, the server authorizes a matching public key, commonly from the user’s ~/.ssh/authorized_keys. The private key remains with the client; the server checks proof that the client controls it. Review changes to authorized keys when an accepted key login is unexpected.
Free tools Windows power users keep installed
One-click scans. No signup required.
Correlate a suspected successful login
Build a timeline around the accepted event instead of treating it as an isolated verdict. Preserve the account, source address, method and exact time, then check related records supplied by this host’s PAM, sudo and audit configuration.
- Session opening and closing: look for records showing when the session or process started and ended.
- Terminal or process context: note the assigned TTY, session identifier or child process where logged.
- Privilege escalation: inspect
sudoand other administrative-action records for the same account and time range. - Key persistence: compare
~/.ssh/authorized_keyswith a known-good copy and review its modification time. - Account and source ownership: verify that the account, key and address match a scheduled maintenance task or authorized operator.
- Follow-on activity: investigate unexpected service changes, new accounts, cron entries or files using the host’s available audit data.
The amount of detail available depends on enabled logging and retention. Absence of a follow-on record is not proof that no action occurred; it may indicate that the relevant subsystem was not configured to log it.
Use last to validate the session timeline
The last command reads the system-wide wtmp login and logout accounting file and prints entries newest first. It complements sshd records; it is not a replacement for failed-authentication logs.
last -ai | head -30The -i option prints a stored IP address instead of resolving it to a hostname. Compare the time, account and address shown by last with the accepted sshd line. Accounting data can be rotated or incomplete, so use it to validate a timeline rather than as the sole source of truth.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
A repeatable investigation workflow
- Identify the authoritative store. Check the authentication log path and query both possible systemd units,
sshandsshd, until you find where current events appear. - Set a bounded time range. Use a precise start and end time in
journalctl, or isolate the relevant rotated log file before searching. - Save the unfiltered evidence. Export complete lines with timestamps and host context before using
grep, sorting or field extraction. - Classify each result. Separate failed passwords, invalid users, generic authentication failures and accepted methods. Do not collapse all of them into “break-in.”
- Group by address and account. Look for bursts, repeated usernames, regular timing and sources that move from failures to an accepted event.
- Search for accepted events. Match account, source and method, then inspect session, privilege and key records in the same window.
- Validate with accounting. Compare the accepted-session timeline with
last -aiand note any rotation or retention gap. - Preserve and contain. Copy relevant logs, protect them from alteration, and use firewall or account controls only after checking that legitimate operators will not be locked out.
- Strengthen the authentication path. Replace weak passwords with carefully managed keys or multi-factor authentication, and review which accounts are allowed to use SSH.
What Fail2Ban can and cannot do
Fail2Ban scans files such as /var/log/auth.log, matches failed-authentication filters, counts matches within a time window and can update firewall rules to reject new connections. Its jails combine a filter with an action. A systemd backend can read journal entries instead of a flat file.
| Setting | Meaning | Operational question |
|---|---|---|
findtime |
Window in which matching failures are counted | How quickly must attempts accumulate to be considered one burst? |
maxretry |
Number of matches allowed before the jail acts | How many failures should occur before a ban is triggered? |
bantime |
How long the firewall action rejects the address | How long should repeated traffic be rate-limited? |
| Backend | File monitoring or systemd-journal reading | Is the jail watching the store this host actually uses? |
| Action | Firewall or other response applied after a match | Will the selected action work with this host’s firewall and network? |
After installation and configuration, inspect the global and SSH-jail status:
sudo fail2ban-client status
sudo fail2ban-client status sshdDocument the selected thresholds, backend, action and any allowlist. Reverse DNS can disagree with forward DNS, so decisions should be based on the logged IP address where possible. Carefully allowlist trusted administration addresses, because an overly broad ban can block legitimate access.
Fail2Ban is rate control, not authentication. Its documentation states that it can reduce the rate of incorrect attempts but cannot eliminate the risk presented by weak authentication. A ban does not identify the person behind an address, and it does not undo a successful login that occurred before the ban.
Choose the right tool for the question
| Tool or source | Data source | Best use | Limit |
|---|---|---|---|
| Authentication log | Flat file and rotated copies | Search exact sshd wording and retain raw lines | Path and retention vary by distribution |
journalctl |
systemd journal | Filter by service unit, time range and live follow mode | Requires the relevant unit and journal retention |
last |
wtmp accounting |
Validate stored login/logout and IP timelines | Does not provide a complete record of failed SSH attempts |
| Fail2Ban | Configured log or journal backend | Apply filters, thresholds and firewall actions automatically | Reduces repeated attempts but does not fix weak authentication or prove identity |
Use the log or journal for event detail, last for historical accounting, and Fail2Ban when you need an automated response. None should be treated as a substitute for the others.
Common interpretation mistakes
Calling every failure an intrusion
Internet-facing SSH services are routinely scanned. Classify activity by repetition, source, target accounts, timing and any later accepted event instead of labeling one mistyped password as a compromise.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Assuming a missing file means missing evidence
A systemd journal may be the authoritative store when /var/log/auth.log is absent. Query the SSH unit and verify retention before deciding that the host has no history.
Treating one accepted line as malicious by itself
Compare the account, source, key ownership and maintenance schedule, then inspect session and privilege records. An accepted event can be a legitimate administrator, an automated job or an unauthorized user; the surrounding context determines which.
Trusting a reverse-DNS name
Hostnames can be absent, stale or inconsistent with forward DNS. Preserve and compare the numeric source address, and treat a DNS name as context rather than identity.
Leaving automated bans unexplained
Record the jail’s findtime, maxretry, bantime, backend, action and allowlist. Without those details, an operator cannot explain why an address was blocked or reproduce the decision.
Hardening after you finish the review
- Use public-key authentication with protected private keys instead of relying on weak or reused passwords.
- Add multi-factor authentication where the SSH deployment and PAM stack support it.
- Remove or disable accounts that do not need SSH access, and review authorized keys regularly.
- Keep sufficient journal and authentication-log retention to cover the period in which an incident might be discovered.
- Test the logging path with an authorized login and confirm that the expected file or journal unit records it.
- Keep a copy of relevant logs before rotating, deleting or changing authentication configuration.
- When deploying Fail2Ban, test an allowlisted administration address and verify that the configured firewall action actually rejects a test source.
These controls address different risks: keys and multi-factor authentication raise the cost of credential guessing, account review reduces the available targets, retention preserves evidence, and Fail2Ban slows repeated connections.
Quick Recap
Incident-response checklist
- Record the host, timezone, time window and logging source.
- Preserve raw authentication-log or journal entries before filtering.
- List failed and accepted events separately, with account, source and method.
- Check session, privilege-escalation and authorized-key changes around every unexpected acceptance.
- Compare accepted sessions with
last -aiand note accounting gaps. - Determine whether a source is approved, shared, proxied or unknown before blocking it.
- Apply temporary containment while preserving access for authorized operators.
- Rotate credentials or keys and review account scope if unauthorized access is plausible.
- Document Fail2Ban thresholds and confirm that its backend reads the active log store.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
