How to Find, Export, and Investigate SSH Logs on Linux

Summary

A practical guide to locating and exporting SSH logs across Linux distributions, interpreting authentication events, and checking for suspicious logins. It covers permissions, journal retention, rotated files, timestamps, and OpenSSH 9.8 log tags.

Key points

Debian and Ubuntu commonly store SSH logs in /var/log/auth.log; Red Hat-family systems use /var/log/secure. Journal-only systems can be queried with journalctl -u ssh or -u sshd.
The guide provides commands to export current and rotated log files or filter journal entries by service unit and time range.
Log access may require sudo or membership in groups such as adm or systemd-journal. Journals kept only in memory are lost on reboot.
Filter by systemd unit rather than the sshd tag: OpenSSH 9.8 split per-connection messages into sshd-session.
A sequence of failed or invalid-user attempts followed by a successful login from the same IP is a suspicious pattern to investigate.
SSH logs can contain usernames, source IPs, and hostnames; the article advises checking data-handling policies before uploading them to LogTotal.
Local logs may be altered or deleted on a compromised server; compare them with logs forwarded to a SIEM when available.

Article Details

Defense Focus: Collect, preserve, sanitize, and analyze Linux SSH authentication logs to detect suspicious logins and investigate potential compromise.
Detection Methods: Review sshd authentication records for repeated failed-password or invalid-user attempts from one IP followed by a successful login from that same IP.
Investigate successful logins to service accounts from unfamiliar addresses or at unusual hours.
Use Sigma detections through LogTotal to analyze exported sshd logs.
Compare local authentication logs with SIEM or forwarded logs when local logs may have been altered or removed.
Data Sources: Linux authentication files: /var/log/auth.log and /var/log/secure, including rotated and compressed files.
systemd journal entries for the ssh and sshd units.
SIEM or forwarded log copies.
Relevant fields include timestamps, usernames, source IPs, hostnames, authentication outcomes, and public-key fingerprints.
Rule Types: Sigma rules
Platforms: LogTotal
SIEM
Defensive Actions: Export both current and rotated authentication logs, or query the journal by ssh and sshd unit; include an appropriate incident time range.
Use unit filters rather than the sshd journal tag on OpenSSH 9.8 and later, because per-connection messages may use the sshd-session tag.
Preserve logs before restarting a system when the journal is volatile; check for persistent journal storage and consult SIEM or forwarded copies.
Record the server time zone when exported syslog timestamps lack time-zone information.
Sanitize logs before upload and review the sanitized data; follow organizational data-handling policies.
Use least-privilege access for log collection, such as appropriate adm or systemd-journal membership instead of granting root access.