HowToMonitorSystemAuthenticationLogsonUbuntu:AComprehensiveGuide

Introduction

System authentication logs are one of the most critical components of Linux server security. Every time a user logs in, fails a password attempt, uses sudo, or authenticates via SSH, Ubuntu records the event in its authentication logs. Monitoring these logs is essential for detecting unauthorized access attempts, troubleshooting login issues, and maintaining compliance with security policies.

In this comprehensive guide, you'll learn where Ubuntu stores authentication logs, how to read and filter them effectively, how to set up automated monitoring, and how to build scripts that alert you to suspicious activity in real time.

Understanding Ubuntu Authentication Logs

Ubuntu stores authentication-related log entries in several key locations. Understanding the structure and purpose of each file is the first step toward effective monitoring.

Key Log Files

• /var/log/auth.log — The primary authentication log file. It captures all authentication-related events including SSH logins, sudo usage, PAM module activity, and su commands.
• /var/log/syslog — A general-purpose log that may include authentication-related messages alongside other system events.
• /var/log/faillog — Stores failed login attempt counts per user (binary format, read with the faillog command).
• /var/log/lastlog — Records the last login time for each user (binary format, read with the lastlog command).
• /var/log/wtmp and /var/log/btmp — Binary logs for successful and failed login sessions respectively, readable via last and lastb commands.

Viewing Authentication Logs with Basic Commands

Let's start with the most fundamental ways to inspect your authentication logs.

Reading auth.log Directly

The simplest approach is to view the raw log file:

# View the entire auth.log file
sudo cat /var/log/auth.log

# View the last 50 lines
sudo tail -n 50 /var/log/auth.log

# Follow the log in real time
sudo tail -f /var/log/auth.log

The tail -f command is particularly useful during active troubleshooting, as it streams new entries to your terminal as they occur.

Using grep to Filter Log Entries

Raw logs can be overwhelming on a busy server. Use grep to isolate specific events:

# Find all failed password attempts
sudo grep "Failed password" /var/log/auth.log

# Find all successful SSH logins
sudo grep "Accepted publickey\|Accepted password" /var/log/auth.log

# Find all sudo commands executed
sudo grep "sudo:" /var/log/auth.log

# Find authentication failures for a specific user
sudo grep "Failed password for admin" /var/log/auth.log

# Find all session opened/closed events
sudo grep "session opened\|session closed" /var/log/auth.log

Using journalctl for Systemd-Based Log Analysis

Modern Ubuntu systems use systemd and its journal daemon. The journalctl command provides powerful filtering capabilities that go beyond what traditional log files offer.

# View all authentication-related journal entries
sudo journalctl -u ssh.service

# View auth entries from the last hour
sudo journalctl -u ssh.service --since "1 hour ago"

# View entries from a specific date range
sudo journalctl -u ssh.service --since "2024-01-15 08:00:00" --until "2024-01-15 18:00:00"

# Follow SSH authentication events in real time
sudo journalctl -u ssh.service -f

# View only authentication-related messages with priority levels
sudo journalctl SYSLOG_FACILITY=10 -p err

# Output in JSON format for programmatic parsing
sudo journalctl -u ssh.service -o json-pretty --since "today"

The journalctl tool supports time-based filtering, priority levels, and multiple output formats, making it ideal for both interactive use and scripted automation.

Analyzing Failed Login Attempts

One of the most important security monitoring tasks is tracking failed authentication attempts. A sudden spike in failures can indicate a brute-force attack.

Counting Failed Attempts by IP Address

# Extract and count failed SSH login attempts by source IP
sudo grep "Failed password" /var/log/auth.log \
  | awk '{print $(NF-3)}' \
  | sort \
  | uniq -c \
  | sort -rn \
  | head -20

This command pipeline extracts IP addresses from failed password entries, counts occurrences, sorts them in descending order, and displays the top 20 offenders.

Counting Failed Attempts by Username

# Find the most targeted usernames in failed login attempts
sudo grep "Failed password" /var/log/auth.log \
  | awk '{for(i=1;i<=NF;i++) if($i=="for") print $(i+1)}' \
  | sort \
  | uniq -c \
  | sort -rn \
  | head -20

If you see many failed attempts targeting usernames like root, admin, or test, it's a strong indicator of automated brute-force attacks.

Using lastb and last Commands

# View recent failed login attempts (requires root)
sudo lastb | head -20

# View recent successful logins
last | head -20

# View the last login time for all users
lastlog

# View login history for a specific user
last username

Building a Custom Monitoring Script

For ongoing security monitoring, you can create a Bash script that generates a daily authentication summary report.

#!/bin/bash
# auth-monitor.sh — Daily Authentication Log Monitor
# Usage: Run via cron or manually

LOG_FILE="/var/log/auth.log"
REPORT_FILE="/tmp/auth-report-$(date +%Y%m%d).txt"
ALERT_THRESHOLD=10
EMAIL_RECIPIENT="admin@example.com"

echo "=== Authentication Log Report ==="  > "$REPORT_FILE"
echo "Generated: $(date)"               >> "$REPORT_FILE"
echo "Server: $(hostname)"               >> "$REPORT_FILE"
echo ""                                  >> "$REPORT_FILE"

# Count total failed login attempts today
TODAY=$(date +"%b %e")
FAILED_COUNT=$(grep "$TODAY" "$LOG_FILE" | grep -c "Failed password")
SUCCESS_COUNT=$(grep "$TODAY" "$LOG_FILE" | grep -c "Accepted")
SUDO_COUNT=$(grep "$TODAY" "$LOG_FILE" | grep -c "sudo:")

echo "=== Summary ==="                    >> "$REPORT_FILE"
echo "Failed login attempts:  $FAILED_COUNT"  >> "$REPORT_FILE"
echo "Successful logins:      $SUCCESS_COUNT" >> "$REPORT_FILE"
echo "Sudo commands executed:  $SUDO_COUNT"   >> "$REPORT_FILE"
echo ""                                       >> "$REPORT_FILE"

# Top offending IP addresses
echo "=== Top 10 Failed Login IPs ==="     >> "$REPORT_FILE"
grep "$TODAY" "$LOG_FILE" \
  | grep "Failed password" \
  | awk '{print $(NF-3)}' \
  | sort | uniq -c | sort -rn \
  | head -10                              >> "$REPORT_FILE"
echo ""                                    >> "$REPORT_FILE"

# Top targeted usernames
echo "=== Top 10 Targeted Usernames ==="   >> "$REPORT_FILE"
grep "$TODAY" "$LOG_FILE" \
  | grep "Failed password" \
  | awk '{for(i=1;i<=NF;i++) if($i=="for") print $(i+1)}' \
  | sort | uniq -c | sort -rn \
  | head -10                              >> "$REPORT_FILE"
echo ""                                    >> "$REPORT_FILE"

# Successful SSH logins
echo "=== Successful SSH Logins ==="       >> "$REPORT_FILE"
grep "$TODAY" "$LOG_FILE" \
  | grep "Accepted"                       >> "$REPORT_FILE"

# Alert if failed attempts exceed threshold
if [ "$FAILED_COUNT" -gt "$ALERT_THRESHOLD" ]; then
  echo "[ALERT] High number of failed login attempts detected: $FAILED_COUNT" >> "$REPORT_FILE"
  if command -v mail &> /dev/null; then
    mail -s "[SECURITY ALERT] $(hostname): $FAILED_COUNT failed login attempts" \
      "$EMAIL_RECIPIENT" < "$REPORT_FILE"
  fi
fi

cat "$REPORT_FILE"
echo ""
echo "Report saved to: $REPORT_FILE"

Make the script executable and schedule it with cron:

# Make the script executable
chmod +x /usr/local/bin/auth-monitor.sh

# Add a cron job to run daily at 8 AM
sudo crontab -e
# Add this line:
# 0 8 * * * /usr/local/bin/auth-monitor.sh

Real-Time Monitoring with watch and multitail

For interactive, real-time monitoring sessions, Ubuntu offers several useful tools:

# Refresh failed login count every 5 seconds
watch -n 5 'grep -c "Failed password" /var/log/auth.log'

# Install and use multitail for colorized, multi-file monitoring
sudo apt install multitail -y
sudo multitail /var/log/auth.log /var/log/syslog

# Use ccze for colorized log output
sudo apt install ccze -y
sudo tail -f /var/log/auth.log | ccze -A

Setting Up Logwatch for Automated Reports

Logwatch is a mature log analysis tool that can automatically generate and email daily summaries of your system's log activity, including authentication events.

# Install Logwatch
sudo apt update
sudo apt install logwatch -y

# Generate an immediate authentication report
sudo logwatch --service sshd --detail High --range today --output stdout

# Configure Logwatch for daily email reports
sudo nano /usr/share/logwatch/default.conf/logwatch.conf

Key configuration options to set in the Logwatch config:

Output = mail
MailTo = admin@example.com
MailFrom = logwatch@yourserver.com
Detail = High
Range = yesterday

Integrating with Fail2Ban for Active Protection

Monitoring logs is only half the battle. Fail2Ban reads your authentication logs in real time and automatically bans IP addresses that exhibit malicious behavior.

# Install Fail2Ban
sudo apt update
sudo apt install fail2ban -y

# Create a local configuration override
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

Add or modify the SSH jail configuration:

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 5
bantime = 3600
findtime = 600

This configuration bans any IP address for one hour after five failed login attempts within a 10-minute window. Start and enable Fail2Ban:

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

# Check the status and currently banned IPs
sudo fail2ban-client status sshd

Log Rotation and Retention

Ubuntu uses logrotate to manage log file sizes and retention. Authentication logs are typically rotated weekly and kept for four weeks. You can inspect and customize this behavior:

# View the current auth.log rotation configuration
cat /etc/logrotate.d/rsyslog

# Check available rotated log files
ls -la /var/log/auth.log*

If you need longer retention for compliance, edit the rsyslog logrotate configuration:

sudo nano /etc/logrotate.d/rsyslog

Modify the rotate directive to increase the number of archived files kept. For example, setting rotate 12 with weekly rotation keeps approximately three months of logs.

Advanced: Sending Logs to a Central Server

For environments with multiple servers, centralizing authentication logs improves visibility and makes it harder for attackers to tamper with evidence. You can configure rsyslog to forward authentication logs:

# On the Ubuntu client, edit rsyslog configuration
sudo nano /etc/rsyslog.d/50-auth-forward.conf

# Add the following line to forward auth facility logs
auth,authpriv.*    @@logserver.example.com:514

The double @@ symbol indicates TCP transport. Restart rsyslog to apply the changes:

sudo systemctl restart rsyslog

Security Best Practices

• Restrict log file permissions: Ensure /var/log/auth.log is readable only by root and the syslog group: chmod 640 /var/log/auth.log.
• Enable immutable log backups: For critical servers, ship logs off-server in real time so attackers cannot erase their tracks.
• Disable root SSH login: Set PermitRootLogin no in /etc/ssh/sshd_config and monitor for attempts to log in as root regardless.
• Use key-based authentication: Passwords are inherently more vulnerable to brute-force attacks. Monitor for unexpected password-based logins even if you have keys configured.
• Set up alerts: Don't just collect logs — create actionable alerts for anomalous patterns like logins from unexpected geographic locations or off-hours access.
• Audit sudo usage: Monitor the auth log for sudo commands to ensure privilege escalation is authorized and expected.

Conclusion

Monitoring authentication logs on Ubuntu is a foundational security practice that every system administrator should master. By combining manual inspection with tools like journalctl, automated scripts, Logwatch, and Fail2Ban, you can build a robust monitoring pipeline that detects threats early and helps you respond quickly.

Start with the basics — familiarize yourself with /var/log/auth.log and the filtering commands covered in this guide. Then progressively layer on automation, alerting, and centralized logging as your infrastructure grows. Consistent log monitoring is not just about security; it's about maintaining confidence that your systems are operating as expected.