Where Are Linux Auth Logs Stored?
Linux auth.log and secure files with SSH logins, sudo use and failures.
Last updated
Linux records SSH logins, sudo invocations and authentication failures in the auth log, named auth.log on Debian family and secure on RHEL family. Failed password lines are the first thing checked after any brute-force alert.
Systemd systems duplicate much of this into the journal. Centralize the file with rsyslog forwarding or lose it on compromise.
Where Linux stores this, by platform
/var/log/auth.log
Debian and Ubuntu authentication log with sshd and sudo entries. RHEL family uses /var/log/secure instead with the same content. Grep for Failed password and Accepted to triage incidents. Forward it off-host; local logs are the first thing attackers scrub.
Frequently asked questions
Where are failed SSH logins logged?
In the auth log above as Failed password lines with source IPs. Pair with fail2ban to block repeat offenders automatically.
auth.log versus secure?
Same log, different distro names: auth.log on Debian and Ubuntu, secure on RHEL, Fedora and Arch neighbors. Check both names on unfamiliar systems.
Notice an outdated path? Let us know.