How to check failed SSH login attempts

Failed SSH login attempts are a primary signal of brute-force attacks, credential stuffing, and opportunistic scanning against Internet-facing systems. Monitoring these events highlights suspicious sources, reveals weak accounts that attract guessing, and provides evidence when intrusion attempts escalate into incidents.

On Linux systems, OpenSSH logs authentication activity through the system logging stack, either in the persistent systemd journal or in classic text log files under /var/log. Entries typically include timestamp, hostname, sshd process ID, message type, username, and remote IP address, which makes it possible to filter out failed attempts by message text and aggregate them by source.

Access to authentication logs usually requires elevated privileges and differs between distributions because of distinct logging facilities and file paths. Journal retention, log rotation, and any remote log forwarding also influence how much history remains available. Knowing whether the system uses /var/log/auth.log, /var/log/secure, or only the journal is essential before extracting statistics on failed login attempts.

1. Open a terminal with sudo privileges.

   $ whoami
   user

2. Review the systemd journal for SSH messages containing failure patterns.

   $ sudo journalctl _SYSTEMD_UNIT=ssh.service | egrep -i "fail|invalid|did"
   Mar 09 21:29:44 hostname sshd[159262]: Connection closed by invalid user elijah 45.9.20.25 port 19890 [preauth]
   Mar 09 21:37:57 hostname sshd[159313]: Disconnected from invalid user user 92.255.85.237 port 36150 [preauth]
   Mar 09 21:49:54 hostname sshd[159416]: Disconnected from invalid user srvadmin 212.156.17.218 port 2066 [preauth]
   Mar 09 21:54:13 hostname sshd[159449]: Disconnected from invalid user admin 92.255.85.237 port 40370 [preauth]
   Mar 09 22:12:38 hostname sshd[159624]: Disconnected from invalid user ftpuser 92.255.85.237 port 46496 [preauth]
   Mar 09 22:26:57 hostname sshd[159710]: Disconnected from invalid user ashok 129.28.166.144 port 57222 [preauth]
   Mar 09 22:27:01 hostname sshd[159714]: Disconnected from invalid user devops 106.12.176.246 port 34244 [preauth]
   Mar 09 22:27:19 hostname sshd[159718]: Disconnected from invalid user test3 43.153.6.100 port 43992 [preauth]
   Mar 09 22:29:41 hostname sshd[159733]: Disconnected from invalid user sabine 143.244.174.143 port 46854 [preauth]
   Mar 09 22:30:31 hostname sshd[159740]: Disconnected from invalid user user 203.95.212.41 port 34548 [preauth]
   Mar 09 22:30:32 hostname sshd[159742]: Disconnected from invalid user upgrade 31.220.55.239 port 57506 [preauth]
   Mar 09 22:31:40 hostname sshd[159749]: Disconnected from invalid user ftp 92.255.85.135 port 53048 [preauth]
   Mar 09 22:32:06 hostname sshd[159753]: Connection closed by invalid user aaa 176.111.173.44 port 40974 [preauth]
   Mar 09 22:41:42 hostname sshd[159849]: Connection closed by invalid user email 45.9.20.25 port 24870 [preauth]
   Mar 09 23:08:05 hostname sshd[160009]: Disconnected from invalid user reboot 61.155.2.142 port 35393 [preauth]
   Mar 09 23:21:17 hostname sshd[160124]: Disconnected from invalid user haha 134.209.118.137 port 43918 [preauth]
   Mar 09 23:22:18 hostname sshd[160132]: Connection closed by invalid user admin 176.111.173.242 port 58432 [preauth]

   Filtering directly in the journal is useful on systems that do not write /var/log/auth.log or /var/log/secure.

3. Determine the logging facility type used by the SSH server.

   $ sudo sshd -T | grep syslogfacility
   syslogfacility AUTH

   Distribution	Logging facility
   Ubuntu	AUTH
   Red Hat	AUTHPRIV

4. Locate the log file corresponding to the configured logging facility.

   $ sudo grep -nir auth /etc/[r]syslog*
   /etc/rsyslog.d/50-default.conf:8:auth,authpriv.*      /var/log/auth.log
   /etc/rsyslog.d/50-default.conf:9:*.*;auth,authpriv.none   -/var/log/syslog
   /etc/rsyslog.d/50-default.conf:29:# auth,authpriv.none;\
   /etc/rsyslog.d/50-default.conf:32:# auth,authpriv.none;\

   Distribution	SSH log file
   Ubuntu	/var/log/auth.log
   Red Hat	/var/log/secure
   Generic	/var/log/messages, /var/log/syslog

5. Extract entries for failed SSH login attempts from the authentication log file.

   $ sudo grep -E "sshd.*(Failed|Invalid|Did)" /var/log/auth.log | grep -v COMMAND
   Feb 27 00:24:27 hostname sshd[48111]: Invalid user backups from 91.255.85.231 port 56900
   Feb 27 00:38:59 hostname sshd[48132]: Invalid user admin from 179.43.141.166 port 37774
   Feb 27 00:40:35 hostname sshd[48168]: Invalid user array from 91.255.85.134 port 46940
   Feb 27 00:47:06 hostname sshd[48178]: Invalid user austin from 193.169.255.199 port 23966
   Feb 27 00:47:13 hostname sshd[48183]: Invalid user  from 64.61.197.182 port 48306
   Feb 27 00:47:14 hostname sshd[48180]: Invalid user auto from 193.169.255.199 port 38018
   Feb 27 00:47:21 hostname sshd[48185]: Invalid user avangard19 from 193.169.255.199 port 57448

   Searched keywords	Reason
   Failed password for …	Incorrect password used to log in
   Invalid user …	Unknown user used to log in
   Did not receive identification … (optional)	Login not actually attempted, often caused by port scanners

6. Retrieve the list of remote IP addresses associated with failed SSH login entries.

   $ sudo grep -E "sshd.*(Failed|Invalid|Did)" /var/log/auth.log | grep -v COMMAND | awk -F 'from ' '{ print $2 }' | awk '{ print $1 }'
   91.255.85.231
   179.43.141.166
   91.255.85.134
   193.169.255.199
   64.61.197.182
   193.169.255.199
   193.169.255.199

7. Identify unique IP addresses that generated failed login attempts.

   $ sudo grep -E "sshd.*(Failed|Invalid|Did)" /var/log/auth.log | grep -v COMMAND | awk -F 'from ' '{ print $2 }' | awk '{ print $1 }' | sort | uniq
   179.43.141.166
   193.169.255.199
   64.61.197.182
   91.255.85.134
   91.255.85.231

8. Count the number of failed SSH login attempts originating from each IP address.

   $ sudo grep -E "sshd.*(Failed|Invalid|Did)" /var/log/auth.log | grep -v COMMAND | awk -F 'from ' '{ print $2 }' | awk '{ print $1 }' | sort | uniq -c
         1 179.43.141.166
         3 193.169.255.199
         1 64.61.197.182
         1 91.255.85.134
         1 91.255.85.231

   Sorting and counting by IP address highlights sources responsible for repeated failures and can feed into blocking rules or intrusion detection policies.