To investigate SSH activity, first identify where the host records authentication events: a traditional authentication log or the systemd journal. Then classify each event by result, account, source address, method and time. A burst of Failed password or Invalid user entries is evidence of probing or brute-force activity, but it is not proof that anyone gained access. A suspected compromise requires correlation with an Accepted event, session records, privilege-use logs and the account’s authorized keys.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Find the log that actually contains SSH events
There is no single universal SSH log path. The distribution, logging daemon and service configuration determine whether authentication records are written to a flat file, retained by systemd-journald, or both. Absence of one expected file does not mean that SSH produced no events.
As an Amazon Associate I earn from qualifying purchases.
Traditional authentication logs
On many syslog-oriented systems, SSH records appear in an authentication log, commonly /var/log/auth.log. Other distributions use a different file or route authentication messages through a custom syslog rule. Check the host’s logging configuration and rotation policy before deciding that a time period is empty. If logs have rotated or been forwarded to a central collector, the local file may contain only part of the history.
To search a traditional log while retaining the original context, start with a broad match:
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
sudo grep -E 'Failed password|Invalid user|authentication failure|Accepted ' /var/log/auth.logReplace the path with the authentication log used on the host. Save the unfiltered lines before applying narrower searches so that timestamps, hostnames, process names and wording remain available for later correlation.
systemd journal records
On a systemd host, query the SSH service unit directly. Service names differ, so test both common unit names and use the one that exists:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minutesudo journalctl -u ssh --since "24 hours ago" --output short-iso
sudo journalctl -u sshd --since "24 hours ago" --output short-isoThe -u option selects a systemd unit. --since and --until limit the time range, and --output short-iso prints RFC 3339-style timestamps that are easier to compare across systems. For an investigation in progress, follow new entries continuously:
sudo journalctl -f -u ssh
sudo journalctl -f -u sshdStop a follow operation with Ctrl+C. If neither unit returns events, inspect the running service name and the journal’s retention period before concluding that SSH is inactive.
Preserve timezone and host identity
Copy the original lines, including the timezone or offset where available, the hostname and the daemon/process identifier. A timestamp without timezone context can put events in the wrong order when you compare a local log with a firewall, cloud or central logging system. If several servers are involved, keep each hostname attached to its records.
Understand the fields in an SSH record
For every event that may matter, record the following fields. The exact wording and order vary by distribution, OpenSSH version and PAM configuration, but the investigative questions are stable.
| Field | What it tells you | Why it matters |
|---|---|---|
| Timestamp | When the daemon recorded the event, with the host’s timezone or offset | Lets you group bursts and compare SSH activity with other logs |
| Daemon and process | Usually an SSH service or a pre-authentication child process | Confirms that the line belongs to the SSH service you are investigating |
| Result wording | For example, Failed password, Invalid user, authentication failure or Accepted |
Separates rejected attempts from an authentication that was accepted |
| Account name | The username supplied or authenticated | Shows whether attempts target real accounts, random names or a privileged account |
| Source address or hostname | The peer address recorded by the daemon | Allows grouping, firewall review and timeline correlation |
| Source port | The client-side TCP port, when logged | Helps distinguish separate connections; it is not an identity |
| Method | Password, public key, keyboard-interactive, GSSAPI or host-based authentication when stated | Reveals which authentication path was attempted or accepted |
| Pre-authentication state | Whether the connection failed before a session was established | Prevents treating an early handshake failure as a logged-in session |
Do not infer meaning from a single column. Read the complete line and nearby records. A source hostname may be a reverse-DNS label rather than a trustworthy identity, and an account name alone does not establish who operated it.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Recognize probing and brute-force patterns
Internet-facing SSH services are routinely scanned. The useful question is not whether one failed line exists, but whether the activity forms a pattern that is consistent with automated guessing or account enumeration.
High-signal patterns
- Many failures from one source address within a short interval.
- Repeated attempts against several usernames, especially a sequence of common or nonexistent names.
- A regular cadence that continues for minutes or hours, suggesting automation rather than an occasional mistyped password.
- Attempts that rotate among addresses while keeping the same username or timing pattern.
- Failures followed closely by an
Acceptedevent from the same source, account or related source range.
An isolated failure from an unfamiliar address can be a typo, a stale automation job or ordinary scanning. Repetition, breadth of usernames and timing make the classification stronger. None of these signals, by themselves, proves that an attacker successfully entered.
Search failures without losing the original evidence
A focused search can quickly show the volume and wording of failures:
sudo grep -E 'Failed password|Invalid user|authentication failure' /var/log/auth.logTo count likely source fields in a common log format, an example pipeline is:
sudo grep -E 'Failed password|Invalid user|authentication failure' /var/log/auth.log
| awk '{print $(NF-5)}' | sort | uniq -c | sort -nr | headThe awk field position is not universal. Message formats, added fields and distribution-specific prefixes can move the address to another position. Inspect representative lines first, then verify that the extracted value is really an address. Fail2Ban filters are designed to parse failed-authentication formats and extract a host, so use their parsing logic rather than assuming one column number is valid everywhere.
Group by account and source
Count both dimensions: a single address trying many names indicates enumeration, while many addresses trying one valid account can indicate a distributed password attack. Keep the time window explicit. A count over a week can hide whether the attempts arrived in one burst or as isolated events.
When a source is represented by a hostname, look for the numeric address in the original record or in a logging field that preserves it. Reverse DNS can be inconsistent or deliberately misleading; it should not be treated as proof of ownership.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Tell an unsuccessful attempt from an accepted login
Failed password, Invalid user and similar messages describe rejected authentication. They answer “was this attempt accepted?” with no. They do not answer “did this person ever get in?” Search the same time range for an Accepted record and capture the account, source address and method.
Authentication methods you must account for
OpenSSH can authenticate with passwords, public keys, keyboard-interactive exchanges, GSSAPI and host-based authentication. A search that only counts password failures therefore covers only one path. Public-key authentication is accepted when the server authorizes the matching public key, normally through the user’s ~/.ssh/authorized_keys file. An attacker using a stolen or newly installed key may never generate a failed-password line.
For an accepted event, write down the exact method. A public-key acceptance points you toward key ownership and file changes; keyboard-interactive may involve PAM or a second factor; GSSAPI and host-based events require correlation with their respective infrastructure.
Correlate the accepted line with session activity
Review records immediately before and after the acceptance:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →- Session-open and session-close entries, including the assigned process or TTY when logged.
sudoor other privilege-escalation records for the same account and time.- Changes to
~/.ssh/authorized_keys, shell startup files or account properties. - Service, deployment and maintenance logs that could explain the connection.
- Network, firewall or bastion records that confirm the source address and connection time.
These records depend on the host’s PAM, sudo, audit and file-monitoring configuration. Their absence does not prove that no session occurred; it may mean that the relevant component was not configured to log, that retention expired or that the account used a method not captured by your search.
Validate the account and key
Compare the accepted username and source with the owner’s expected work. Determine whether the key listed in authorized_keys belongs to that account and whether its comment, fingerprint and installation time are documented. A familiar account does not make an unexpected source safe, and an unfamiliar key does not by itself reveal when it was used. Preserve the file and its metadata for investigation before deleting or replacing anything.
Use last to check historical sessions
The last command reads the system-wide wtmp accounting file and prints stored login and logout records newest first. Where an address is available, last -i prints the numeric IP instead of resolving it to a hostname:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
last -ai | head -30This is useful for validating the timeline of an accepted session: compare the account, start and end times and stored address with the SSH daemon’s Accepted event. Wtmp is not a complete record of failed SSH authentication, and rotation or retention can remove older entries. Use it alongside the SSH log or journal, never as a replacement.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11A mismatch can have benign causes, such as a session that ended unexpectedly, a different service writing accounting records or clock adjustments. Treat it as a prompt to examine surrounding records rather than as automatic proof of tampering.
Choose the right evidence source
| Tool or source | Primary data | Best use | Important limitation |
|---|---|---|---|
| Traditional authentication log | Syslog-formatted SSH and PAM messages | Fast grep searches, archived files and familiar text processing | Path, rotation and field layout differ by distribution |
journalctl |
systemd journal entries, filterable by unit and time | Precise windows, live following and service-specific queries | Unit name and journal retention vary; an incorrect unit query can look empty |
last |
wtmp login/logout accounting |
Historical accepted-session timelines and stored addresses | Does not enumerate failed SSH attempts and may be rotated |
| Fail2Ban | Configured log or journal filters plus counters | Automated rate limiting and firewall bans after repeated matches | Only sees events its filters match and does not prove compromise or identify a person |
Use the flat file or journal for event detail, last for accounting history and Fail2Ban for a configurable response. No one source is a complete forensic record.
Investigate a suspected break-in step by step
- Define the window. Start with the reported time, then include a buffer before the first suspicious failure and after the last accepted or session-close event. Record the timezone.
- Identify the logging backend. Check the configured authentication log and query both
sshandsshdunits if the service name is uncertain. - Export original records. Save unfiltered lines for the source, account, result, method and surrounding context. Do not rely only on a count or a transformed pipeline.
- Classify attempts. Separate failed passwords, invalid users, other authentication failures and accepted methods. Group by source, account and time.
- Search for acceptance. Find every
Acceptedevent in the window, not just those following the most obvious burst. Include public-key and interactive methods. - Correlate sessions. Match accepted records to session-open/close, TTY or process data,
sudoactivity andwtmpentries. - Check persistence. Review
authorized_keys, account changes, scheduled tasks, startup files and relevant service configuration. Preserve evidence before remediation. - Contain carefully. If access is unauthorized, isolate the host or restrict SSH at the network boundary according to your incident process. Avoid deleting logs or keys before collecting copies.
- Document uncertainty. State what is observed, what is inferred and which logging components were not enabled or no longer retained the needed records.
Use Fail2Ban as rate control, not as a verdict
Fail2Ban scans configured files such as /var/log/auth.log, applies filters to failed-authentication messages and bans addresses that exceed a threshold. Its jails combine a filter with an action, commonly a firewall rule. A systemd backend can read journal entries instead of a flat file.
Understand the three controls
| Setting | Meaning | Operational question |
|---|---|---|
findtime |
The interval in which matching failures are counted | How quickly must attempts accumulate to be considered a burst? |
maxretry |
The number of matches allowed before a ban action triggers | How many failures should be tolerated without blocking a legitimate user? |
bantime |
How long the action rejects new connections | Will the period slow automation while avoiding an impractical lockout? |
Record the selected values, backend, filter and action. Without that documentation, an operator cannot explain why an address was banned or why a legitimate administrator was blocked.
Free tools Windows power users keep installed
One-click scans. No signup required.
Check jail status
sudo fail2ban-client status
sudo fail2ban-client status sshdThe first command lists active jails; the second displays the SSH jail’s counters and currently banned addresses when that jail is named sshd. A different jail name requires the name shown by the first command.
Fail2Ban reduces the rate of incorrect authentication attempts; it does not remove the risk of weak authentication. A ban is evidence that a filter saw enough matching events, not proof that the address belongs to a particular attacker or that a login succeeded.
Common interpretation mistakes
Calling every failure an intrusion
Scanning is normal on exposed hosts. Classify activity using repetition, usernames, timing, source grouping and any accepted follow-up. Reserve “compromise” for evidence of unauthorized acceptance or subsequent activity, not for a failed line alone.
Assuming a missing file means no events
The host may write only to the systemd journal, use another authentication-log path, forward records remotely or have already rotated them. Query the SSH unit and inspect retention before making a negative claim.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Treating one accepted line as proof of malicious access
An accepted connection can be an administrator, deployment system, monitoring job or attacker. Compare the account, source, authorized key, maintenance schedule and session activity. The line proves acceptance of an authentication method, not the operator’s intent.
Trusting reverse DNS
A displayed hostname can be stale, forged or inconsistent with forward DNS. Prefer the numeric address recorded by the host and compare it with network telemetry. Do not let a reassuring hostname replace source-address validation.
Relying on one parser field
Message formats change. Before using awk or another positional parser in an alert, inspect sample lines from that host and test the result against known addresses. A filter that silently extracts the wrong field can produce confident but false counts.
Strengthen SSH after the investigation
Once evidence is preserved, reduce the chance that the same path will be abused again. Prefer carefully managed public/private keys or multi-factor authentication over weak passwords. Public-key authentication uses cryptography, and the server authorizes keys listed in ~/.ssh/authorized_keys; protect private keys and remove obsolete authorized keys through a documented process.
- Review which accounts are allowed to use SSH and remove unused accounts.
- Confirm that each authorized key has an owner, purpose and rotation plan.
- Restrict network exposure with firewalls, bastions or approved source ranges where practical.
- Forward authentication logs to protected, access-controlled storage with a retention period that matches your incident needs.
- Monitor both failed and accepted methods so key-based attacks are not invisible to a password-only alert.
- Keep Fail2Ban filters, thresholds, allowlists and firewall actions documented and tested to avoid locking out administrators.
These measures complement log review. Rate limiting slows repeated guesses, but it cannot compensate for weak credentials, stolen private keys or an account that should not have SSH access.
A compact decision checklist
- Where? Did you identify the authoritative file, journal unit and retention period?
- What? Did you preserve complete lines and record result, account, source, method and time?
- How broad? Are failures concentrated by address, account or cadence?
- Accepted? Is there an
Acceptedevent for any method in the relevant window? - Session? Do session accounting,
sudo, TTY/process andwtmprecords support the timeline? - Persistence? Did you inspect authorized keys and account or service changes?
- Response? Are containment and Fail2Ban actions documented without destroying evidence?
- Confidence? Have you separated observed facts from assumptions about identity or intent?
The practical rule is simple: failed records reveal pressure against the authentication boundary; an accepted record identifies a successful authentication event; only correlated session and post-login evidence can show what happened afterward.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
