grep auth.log: Rapid SSH Log Triage on Linux Without Extra Tooling

What is auth.log?

On Debian-based Linux distributions (Ubuntu, Debian), /var/log/auth.log is the plain-text log file that records all authentication events: SSH login attempts, sudo usage, PAM authentication, su invocations, and cron authentication. On Red Hat-based distributions (CentOS, RHEL, AlmaLinux), the equivalent file is /var/log/secure. Because these are plain text files, standard tools — grep, awk, sort, uniq — can extract actionable intelligence without requiring any specialized log analysis software. This makes auth.log grep analysis the fastest path to initial triage on any server, regardless of whether additional tools like fail2ban, auditd, or a SIEM are installed. The file is typically readable only by root and the adm group, providing a basic form of log integrity protection against non-privileged tampering.

Syntax

grep 'Failed password' /var/log/auth.log
grep 'Accepted password' /var/log/auth.log
grep 'sudo' /var/log/auth.log
grep 'Invalid user' /var/log/auth.log
# RHEL/CentOS equivalent
grep 'Failed password' /var/log/secure

The file path differs by distribution: /var/log/auth.log on Debian/Ubuntu, /var/log/secure on RHEL/CentOS/AlmaLinux. Key search terms include: Failed password (failed auth attempts), Accepted (successful logins), Invalid user (non-existent username attempts), sudo (privilege escalation events), and Disconnected (session terminations).

Key grep Options for Log Analysis

Common Use Cases

Extract All Unique IPs with 10+ Failed SSH Attempts Today

The most common immediate triage task: identify which IP addresses are actively attacking the server, how many attempts each has made, and whether they should be manually blocked if fail2ban has not handled them. This one-liner requires no additional tools beyond standard Unix utilities.

grep 'Failed password' /var/log/auth.log | grep "$(date +'%b %e')" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | sort | uniq -c | sort -rn | awk '$1 >= 10 {print $1, $2}'

Find All Successful SSH Logins Today

After identifying a potential compromise, immediately list all successful authentications to determine which accounts were accessed and from which IPs. An unexpected source IP combined with a successful login is a confirmed unauthorized access event.

grep 'Accepted' /var/log/auth.log | grep "$(date +'%b %e')"
grep 'Accepted password\|Accepted publickey' /var/log/auth.log | tail -20

Audit All sudo Commands Executed Today

Every sudo invocation appears in auth.log with the username, the command executed, and whether it was permitted or denied. Reviewing this output reveals what privileged commands were run on the server and whether any unexpected users escalated privileges.

grep 'sudo' /var/log/auth.log | grep "$(date +'%b %e')" | grep -v 'pam_unix'
grep 'sudo.*COMMAND' /var/log/auth.log | tail -30

Security Relevance: Zero-Tool Rapid Triage

Practical Examples

One-liner: top attacking IPs with attempt count from today's auth.log

grep 'Failed password' /var/log/auth.log | grep "$(date +'%b %e')" | grep -oP 'from \K[^ ]+' | sort | uniq -c | sort -rn | head -15

Uses Perl-compatible regex (-oP) to extract precisely the IP address field from ‘from IP’ patterns in the auth.log format. More reliable than extracting the last IPv4 pattern, which can match port numbers. Returns the top 15 attacking IPs for today with attempt counts.

Find attempts against non-existent usernames (username enumeration or credential stuffing)

grep 'Invalid user' /var/log/auth.log | grep "$(date +'%b %e')" | awk '{print $8}' | sort | uniq -c | sort -rn | head -20

Extracts the attempted username from ‘Invalid user USERNAME from IP’ log entries. High frequency attempts against specific usernames (admin, ubuntu, test, oracle, pi) indicate automated credential stuffing. Attempts against your actual administrative usernames indicate targeted reconnaissance.

Search compressed rotated auth.log archives for historical events

zgrep 'Accepted password' /var/log/auth.log.2.gz
for f in /var/log/auth.log* ; do
  if [[ "$f" == *.gz ]]; then
    zgrep 'Accepted password' "$f"
  else
    grep 'Accepted password' "$f"
  fi
done

Extends the analysis window beyond the current auth.log to rotated archives. Compressed files require zgrep. This is essential when investigating a breach that may have occurred days or weeks ago, before the current log rotation cycle.

Troubleshooting Common Issues

Summary

Grep-based auth.log analysis is the fastest path to SSH security intelligence on any Linux server. The patterns to know — Failed password, Accepted, Invalid user, sudo.*COMMAND — cover the majority of initial triage scenarios. Combine with sort, uniq -c, and awk to extract structured intelligence from unstructured text in seconds. When more comprehensive analysis is needed, escalate to journalctl, lastb, or ausearch based on the specific investigation requirement.

• The four essential search terms: Failed password, Accepted, Invalid user, sudo.*COMMAND — cover 80% of initial triage scenarios
• On RHEL/CentOS, the auth log is /var/log/secure — not auth.log — adjust all commands accordingly
• Pipe through sort | uniq -c | sort -rn to convert any extracted field into a ranked frequency list — instant attack intelligence