Reading auth.log in five minutes

Every SSH login, failed or not, leaves one line in /var/log/auth.log. Four fields in that line answer most questions an analyst asks first.

The four fields

1. Time: when it happened, in the server's clock.
2. Host: which machine wrote it.
3. Process: sshd[1234], the daemon and its process id.
4. Message: what happened.

Finding failed logins

grep "Failed password" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rn | head

The count per source address shows at a glance whether one host is guessing passwords.

What to check next

A burst of failures followed by one success from the same address deserves a closer look.