01Location
- /var/log/auth.log* (rule 'auth,authpriv.* /var/log/auth.log', Ubuntu rsyslog 50-default.conf)
- /var/log/secure* (rule 'authpriv.* /var/log/secure', Red Hat-style rsyslog.conf)
02Questions it answers
- Which accounts authenticated over SSH, with which method, from which address and port?
- Were there failed or invalid-user attempts, and from where?
- Which privileged commands were requested through sudo or su?
03Format and versions
| Format | Line-oriented text written by a syslog daemon (typically rsyslog). With the traditional RFC 3164 style the timestamp is local time 'Mmm dd hh:mm:ss' with no year. |
|---|---|
| Applies to | File names depend on the distribution's syslog rules; systems that rely only on the journal may not have these files at all. |
04Key fields
| Field | What it tells you |
|---|---|
| Timestamp, host, program[pid] | Syslog header fields preceding the message. |
| sshd: 'Accepted <method> for <user> from <ip> port <port> ssh2' | Successful authentication; the method (for example password or publickey) and, where available, key details follow. |
| sshd: 'Failed <method> for [invalid user ]<user> from <ip> port <port> ssh2' | Failed authentication; 'invalid user' marks a non-existent account. |
| sshd: 'Invalid user <user> from <ip> port <port>' | Connection for an account that does not exist. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| Syslog timestamp | RFC 3164 'Mmm dd hh:mm:ss' local time (or a high-precision format if configured) | The year and time zone must be inferred from file context, rotation and system settings. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Collect the current and rotated files (including compressed ones) and the syslog configuration that defines them.
- Establish the year and time zone for each file before converting timestamps.
- Extract sshd Accepted/Failed/Invalid user lines and group them by source address and account.
- Match accepted logins with wtmp sessions and journal entries for the same PID and time.
07Interpretation pitfalls
- sshd logs at VERBOSE level for some failed non-password attempts; at the default LogLevel INFO these may not appear.
- sshd uses the AUTH facility by default; a changed SyslogFacility sends messages elsewhere.
- Text logs are easy to edit; compare with the journal and wtmp for consistency.
- The Red Hat-style rule cited comes from the rsyslog project's sample, which it says may differ from what a distribution ships.
09Sources
- rsyslog 8.2504.0-1ubuntu2 packaging diff (50-default.conf) Ubuntu Patches · checked 2026-10-14
- rsyslog — platform/redhat/rsyslog.conf (sample) rsyslog project (GitHub) · checked 2026-10-14
- OpenSSH portable — auth.c (auth_log) OpenSSH (GitHub) · checked 2026-10-14
- OpenSSH portable — sshd_config(5) OpenSSH (GitHub) · checked 2026-10-14
- RFC 3164 — The BSD syslog Protocol IETF / RFC Editor · checked 2026-10-14
- ForensicArtifacts — artifacts/data/linux.yaml ForensicArtifacts project (GitHub) · checked 2026-10-14