How to View SSH Logs?

Two of the most important questions in security are: who accessed what, and when did they access it? If you have any Linux or Unix machines, you’ll likely find answers in the sshd log. sshd is the Secure Shell Daemon, which allows remote access to the system. In this article, we’ll look at how to view ssh logs.

Most Linux systems these days ship with systemd, including Ubuntu, Amazon Linux 2, and CentOS. On these systems, you can view logs via the journalctl command. In our case, we’re interested in the ssh unit:

You can see the fingerprint of the SSH key is included in the logs. Failed login attempts will appear like this:

If you want to view ssh logs from a specific time range, you can use the since and until flags. Some examples:

To watch the ssh logs in realtime, use the follow flag:

Use Ctrl-C to exit out of the log monitor.

Other methods

On older systems, or systems without systemd, you’ll likely find the sshd log at /var/log/auth.log. You’ll need root permissions to view it, and you’ll probably want to search specifically for sshd logs, like so:

If you’re looking for a quick overview of who’s logged in recently rather than an in-depth audit log, try the lastlog command:

🕵 Learn how Coveo gained complete visibility across their entire stack with centralized and granular audit logs and simplified compliance audits.

Useful log settings

Knowing how to view ssh logs isn’t much help if the logs you’re looking for haven’t been retained. By default, journald retains logs until they consume up to 10% of available disk space. To change this setting, see the SystemMaxUse setting in the journald documentation.

It’s also recommended to increase the sshd log level from the default. Put this setting in /etc/ssh/sshd_config:

This will include more details in the sshd log, like the PID of the user’s login shell. For debugging purposes, you can also try LogLevel DEBUG.

Conclusion

On most modern systems, journalctl provides a convenient, standardized way to view ssh logs. On other systems, you can find the sshd log at /var/log/auth.log. For quick inspections, you can also use the lastlog command. Lastly, remember to configure your servers with the proper log retention and verbosity settings. Happy ssh’ing!