SSH auth.log Analyzer

A server with port 22 open collects thousands of login attempts a day, and auth.log grows until it is far too long to read line by line. Paste the contents here and the page pulls out what matters: how many failures there were, which addresses they came from, which usernames the attackers guessed and whether anyone actually got in. The text never leaves your browser tab.

The count treats a message repeated 4 times line as four failures rather than one. That changes the final number quite a lot, since a brute-force burst of 200 attempts usually takes up half a dozen lines in the file. The syslog stamp, in the form Jul 25 03:14:15, carries no year, so the chronological order used here is the order of the lines themselves, which is how syslog writes them.

The signal worth hunting for is not the volume of failures, it is the coincidence. An IP that shows 400 failures and, somewhere among them, an Accepted password is highlighted in red in the table: the password fell. Blocking the address at that point solves little. The next step is rotating the credential, reviewing authorized_keys for that account and checking what ran after that timestamp.