Where Are Linux Authentication Logs Stored?
Linux auth log paths by distro, auth.log versus secure plus journalctl equivalents for SSH failures.
Last updated
Linux splits auth logs by family. Debian and Ubuntu write /var/log/auth.log while RHEL, Fedora and Alma use /var/log/secure. Systemd systems mirror the same events under journalctl for the sshd unit. The split trips up cross distro guides.
Failed password, invalid user and accepted lines name IPs and accounts directly. Sudo and PAM session entries sit beside SSH lines in the same files. Root reads them with tail or grep; normal users get permission denied. Fail2ban consumes these exact lines for automatic bans. Timestamps order every investigation.
Where Linux Auth Logs stores this, by platform
/var/log/auth.log
Debian family uses auth.log, RHEL family uses secure, systemd mirrors under journalctl sshd. Root only. Grep Failed password for attacks.
Frequently asked questions
How do I find SSH brute force attempts?
Run grep Failed password against your auth file, then aggregate the source field for top IPs. Switch to journalctl with the sshd unit on journal only systems. Fail2ban automates bans from the same data.
Does the file cover sudo usage too?
Yes. Sudo uses, session opens and user creations all land in the same file. Grep sudo and session opened beside sshd lines for the full picture. Timestamps order the story.
Notice an outdated path? Let us know.