Support Online
MirrorLooking Glass
GenixNodeGenixNode
Client Panel
Skip to main content

Ubuntu Login Logs Monitoring Guide: System Security and Authorization Analysis

The foundation of server security is visibility.
You need to know who logged in, when and from where.
With this guide, you will keep your system under constant control.

📌 Technical Summary​

This guide examines authentication records on Ubuntu systems.
The aim is to detect unauthorized access early.

Steps followed:

  • auth.log review
  • Session history analysis
  • User based control
  • Suspicious login filtering
  • Security assessment

🚀 What Will You Learn in This Guide?​

  • Interpreting auth.log lines
  • read past sessions with last
  • user tracking with lastlog
  • Recognizing brute-force attempts
  • Watch live logs

🛠️ Requirements​

Before you start:

  • Ubuntu 20.04 or above
  • SSH access
  • sudo authority
  • Basic Linux knowledge

✅ Step 1: Reading the auth.log File​

This file holds all authorization records.

This command opens the file with pages.

sudo less /var/log/auth.log
  • Pay attention to the following lines:

  1. sshd → SSH connections

  2. Accepted password → Successful login

  3. Failed password → Incorrect attempt

  4. pam_unix → Session logs

  • Press q to exit.

✅ Step 2: Viewing Session History (last)​

  • This command produces regular login report.
last

On output:

  1. Username

  2. IP address

  3. Session duration

  4. Active status

appears.

  • still logged in indicates the active session.

✅ Step 3: User Based Analysis (lastlog)​

  • This command scans all users.
lastlog
  • Never logged in is normal for system accounts.

Unexpected logins for root are risky.

✅ Step 4: Filtering Suspicious Attempts​

  1. List failed logins.
grep "Failed password" /var/log/auth.log
  1. Examine the root entries.
grep "root" /var/log/auth.log
  • These filters are effective in attack detection.

✅ Step 5: Live Log Tracking​

  1. This command provides instant monitoring.
sudo tail -f /var/log/auth.log
  • You instantly see suspicious activities.

📊 Recommended Settings for Security​

Recommended precautions:

  1. Turn off root SSH

  2. Use SSH key

  3. Install Fail2Ban

  4. Change port

  5. Set a strong password

🧩 Troubleshooting​

If the log is not visible:

  1. Check if rsyslog is working

  2. Check disk fullness

  3. Examine file permissions

  4. Check rotation settings

Service status:

systemctl status rsyslog

❓ Frequently Asked Questions​

1. What is a wtmp file? It keeps past session records.

2. What happens if auth.log is deleted? Old records are lost. New registrations continue.

3. How to understand a brute-force attack? Successive unsuccessful attempts are seen.

4. Do logs fill the disk? Logrotate cleans automatically.

5. Can I analyze logs automatically? Yes, it is possible with Fail2Ban and SIEM tools.

🎯 Result​

With this guide:

You analyzed the entries

You learned the risks

You increased security

You protected the server

You can establish secure, traceable and high-performance servers with GenixNode infrastructure. 🚀