auth.log analyzer
Open your Linux authentication log and see who tried to log in over SSH, from where, which logins succeeded and how, what was run with sudo, and which accounts changed. The things worth a second look come first.
sudo tail -n 50000 /var/log/auth.log > auth-sample.logsudo tail -n 50000 /var/log/secure > auth-sample.logsudo journalctl SYSLOG_FACILITY=4 SYSLOG_FACILITY=10 --since "7 days ago" -o short-iso --no-pager > auth-sample.logCopy the file to your computer (for example with scp) and open it below, or paste the text. Traditional syslog lines, RFC 3339 timestamps and journalctl -o short-iso output are all read, including the sshd-session process name OpenSSH 9.8 and later use. Up to 20 MB.
What it looks for
- A login from an address that was failing. Failures followed by an accepted login from the same address is what a successful guess looks like.
- Password and root logins. Each one says password or root login is enabled, which is what makes the failed attempts dangerous.
- Accounts attackers were guessing that also logged in. Usually a common name doing its normal job; worth confirming the source.
- New accounts and administrative groups. A new account with a real shell, a UID 0 account, or membership of sudo, wheel, docker or lxd.
- Privilege use. sudo commands by user and refusals, sudo-rs sessions, and su.
- The background noise, counted. Failed attempts per address and username, and probes that never tried to log in.
Related
Questions
Is my log uploaded anywhere?
No. The file you open or the text you paste is read by this page in your browser and analysed there. There is no request containing it, it is not stored, and it is not sent to analytics. The page counts one anonymous "tool used" event with the tool's name only. You can disconnect from the internet after the page loads and it still works.
Where is the auth log on my server?
On Debian and Ubuntu with rsyslog it is /var/log/auth.log (older entries in auth.log.1 and compressed auth.log.*.gz). On Rocky Linux, AlmaLinux and other RHEL-family systems it is /var/log/secure. On Debian 12 and later without rsyslog there is no file: the same messages are in the systemd journal, and journalctl SYSLOG_FACILITY=4 SYSLOG_FACILITY=10 prints them.
Does a clean result mean my server was not compromised?
No. This reads one log. An attacker with root can edit or delete it, a login through a stolen key looks exactly like a normal login, and anything that happened through a web application never touches the SSH log at all. A quiet log is the absence of one kind of evidence, not proof of safety.
Why are there thousands of failed logins? Am I under attack?
Every server with SSH open to the internet receives automated password guessing from many addresses, all day. The attempts only matter if one can succeed, so the questions to ask are whether password authentication is on, whether root can log in with a password, and whether any successful login came from an address you do not recognise. Those are what this tool puts at the top.
How are attempts counted?
Per address: each "Failed password" (or other failed method) line is one attempt. Where an address has no such lines, which is what a key-only server logs, each connection that was closed before authentication counts as one, or each "Invalid user" notice, whichever is larger. The lines are never added together, because they describe the same attempt from different angles.
Why does a successful login after failures matter?
Because that is what a successful password guess looks like: several failures from one address, then an accepted login from the same address. It is also what a person mistyping their own password looks like, which is why the tool tells you the address and the method so you can tell the two apart.