Skip to main content
To check SSH login attempts on Linux, run w to see who is logged in now, last for past logins and sudo lastb for failed ones. For details from the SSH service itself, run sudo journalctl -u ssh (Ubuntu/Debian) or sudo journalctl -u sshd (AlmaLinux/Rocky), or read /var/log/auth.log (Ubuntu) or /var/log/secure (AlmaLinux/Rocky).

​
Before you start

  • w, who and last work for any user. Failed logins and the system logs need sudo. Root users can leave out sudo.
  • Know your own IP address, so you can tell your logins apart from others.
  • Debian 13 changed how logins are recorded. See the Debian tab in each section.

​
How to see who is logged in right now

Example output:
FROM is the IP address the session came from. who shows the same list in a shorter form. To end a session you do not recognise, note its TTY and run sudo pkill -KILL -t pts/1. Then change that user’s password or SSH keys straight away.

​
How to see past logins

-i shows IP addresses instead of host names and -n 20 limits the list to 20 lines. To see logins since a date, use last -i -s 2026-11-01.
Example output:
To see when each user last logged in, run lastlog (tested on Ubuntu 24.04). On Debian 13, install the lastlog2 package and run lastlog2.

​
How to see failed SSH login attempts

Ask the SSH service log directly:
On Ubuntu you can also search the text log:
sudo lastb -i -n 20 lists failed logins on Ubuntu. Debian 12 and 13 do not create /var/log/auth.log unless you install rsyslog, and Debian 13 has no lastb, so use journalctl there.
Typical lines:
Invalid user means the user name does not exist. Failed password for alex means someone tried a real user name, which is more serious.

​
How to count which IP addresses attack the most

Use -u sshd on AlmaLinux/Rocky. Hundreds of attempts from the internet are normal for any server with SSH open. Fail2Ban or CrowdSec block them automatically, and disabling password login makes them useless.

​
How to see successful SSH logins only

Each line shows the user, source IP and method (publickey or password). A password login when you only use keys, or an IP you do not know, needs action.

​
What to do if you find a login you do not recognise

  1. Note the user, IP address and time.
  2. Check what that user changed: sudo cat /home/USER/.bash_history and sudo ls -la /home/USER/.ssh/.
  3. Follow what to do if your Linux server is hacked.

​
Frequently asked questions

​
Why does journalctl -u ssh show nothing on AlmaLinux?

The service is named sshd there. Use journalctl -u sshd.

​
Why is last empty?

The login record file may have been rotated, or you are on Debian 13 without wtmpdb. Use last -f /var/log/wtmp.1 for the previous file, or search the journal instead.

​
How long are login logs kept?

It depends on your log rotation and journal size settings. Check the journal with journalctl --disk-usage and see read logs with journalctl.

​
Are hundreds of failed logins a sign I have been hacked?

No. Bots scan every public IP address for SSH and try common passwords. They are only a problem if a login succeeds, so check the Accepted lines.

VPS and dedicated server guides

Every guide in this section.

Read logs with journalctl

Filter any service log.

Set up Fail2Ban

Ban IPs that keep failing.

Disable root login

Stop direct root logins.

Server hacked?

Steps to recover safely.
Checked against the Debian 13 release notes, the Debian wtmpdb notes and the util-linux manuals on 4 November 2026; w, who, last, lastb, lastlog and journalctl were tested on Ubuntu 24.04 LTS. Commands can differ on other distributions or releases.

​
Need Extra Help?

If you encounter any issues, our support team is ready to assist:

​
Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!
Last Updated: November 2026