How do I review SSH authentication events on a Linux server?
SSH authentication logs help distinguish incorrect accounts, rejected keys and connection interruptions. Service names and log destinations vary by distribution. Review only the relevant time window and treat account names and source addresses as sensitive operational information when sharing an incident report.
Before you start
- Authorised access to authentication logs.
Instructions
1. Identify the installed SSH service
Debian/Ubuntu commonly uses ssh.service; RHEL-family systems commonly use sshd.service. Query the appropriate installed unit rather than assuming both should exist.
systemctl status ssh.service --no-pagerDebian/Ubuntu example. Substitute sshd.service on a system that uses that unit name.
2. Read its recent events
Keep the service name consistent with the previous step. Correlate the timestamp and intended account with the client’s SSH error.
sudo journalctl -u ssh.service --since "30 minutes ago" -n 100 --no-pagerFor sshd.service systems, change the unit argument accordingly. Some deployments also route authentication messages through a separate syslog file.
Check the result
- A specific client attempt can be matched to a server event, or the lack of a connection points investigation towards the network path and listener.
Troubleshooting
- Failed attempts use unknown accounts
- Review exposure and the established authentication controls. A failed attempt alone does not prove successful compromise.
- No matching event appears
- Confirm timezones, unit/log destination and whether traffic reached this server. Do not disable authentication protections to create a successful test.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.