Ubuntu – Where does Ubuntu 14.04 log SSH access attempts?

14.04logssh

Trying to find out why fail2ban is not working.

Where does Ubuntu 14.04 log SSH access attempts?

Best Answer

All login attempts are logged to /var/log/auth.log

Search for brute-force SSH logins

Run this command:

grep sshd.\*Failed /var/log/auth.log | less

Search for failed connections

Run this command:

grep sshd.*Did /var/log/auth.log | less

UPDATE:

You should try restarting the syslog daemon to see if it starts to log to the correct file.

sudo service rsyslog restart

Once you have messages going to the auth.log it should start working.