> ## Documentation Index > Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt > Use this file to discover all available pages before exploring further. # How to Check SSH Login Attempts and Login History on Linux > Check SSH login attempts on Linux: see who is logged in with w, past logins with last, failed attempts with lastb or journalctl, and read the auth logs. To check SSH login attempts on Linux, run `w` to see who is logged in now, `last` for past logins and `sudo lastb` for failed ones. For details from the SSH service itself, run `sudo journalctl -u ssh` (Ubuntu/Debian) or `sudo journalctl -u sshd` (AlmaLinux/Rocky), or read `/var/log/auth.log` (Ubuntu) or `/var/log/secure` (AlmaLinux/Rocky). | Difficulty | Time | Works on | Needs | | - | - | - | - | | Beginner | 5 minutes | Ubuntu 22.04 / 24.04, Debian 12 / 13, AlmaLinux and Rocky Linux 9 / 10 | Root or sudo access for failed logins and logs | ## Before you start * `w`, `who` and `last` work for any user. Failed logins and the system logs need `sudo`. Root users can leave out `sudo`. * Know your own IP address, so you can tell your logins apart from others. * Debian 13 changed how logins are recorded. See the Debian tab in each section. ## How to see who is logged in right now ```bash theme={null} w ``` Example output: ```text theme={null} 14:02:11 up 12 days, 3:41, 2 users, load average: 0.08, 0.04, 0.01 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT alex pts/0 203.0.113.10 13:55 0.00s 0.04s 0.00s w deploy pts/1 198.51.100.25 13:58 3:12 0.01s 0.01s -bash ``` `FROM` is the IP address the session came from. `who` shows the same list in a shorter form. To end a session you do not recognise, note its `TTY` and run `sudo pkill -KILL -t pts/1`. Then change that user's password or SSH keys straight away. ## How to see past logins > [tab] Ubuntu / AlmaLinux / Rocky > > ```bash theme={null} > last -i -n 20 > ``` > > `-i` shows IP addresses instead of host names and `-n 20` limits the list to 20 lines. To see logins since a date, use `last -i -s 2026-11-01`. > [tab] Debian 13 > > Debian 13 no longer ships `last` in util-linux ([Debian 13 release notes](https://www.debian.org/releases/trixie/release-notes/issues.en.html)). Install `wtmpdb`, which provides a new `last` command: > > ```bash theme={null} > sudo apt install wtmpdb > last > ``` > > On a server upgraded from Debian 12, the package imports the old `/var/log/wtmp` records when you install it. On a fresh Debian 13 server, logins from before you install it are not recorded; use `journalctl` (below) for those. Example output: ```text theme={null} alex pts/0 203.0.113.10 Wed Nov 4 13:55 still logged in alex pts/0 203.0.113.10 Tue Nov 3 09:12 - 10:40 (01:28) reboot system boot 6.8.0-48-generic Mon Oct 23 10:21 still running ``` To see when each user last logged in, run `lastlog` (tested on Ubuntu 24.04). On Debian 13, install the `lastlog2` package and run `lastlog2`. ## How to see failed SSH login attempts > [tab] Ubuntu / Debian > > Ask the SSH service log directly: > > ```bash theme={null} > sudo journalctl -u ssh --since "24 hours ago" | grep -E "Failed password|Invalid user" > ``` > > On Ubuntu you can also search the text log: > > ```bash theme={null} > sudo grep -E "Failed password|Invalid user" /var/log/auth.log | tail -n 20 > ``` > > `sudo lastb -i -n 20` lists failed logins on Ubuntu. Debian 12 and 13 do not create `/var/log/auth.log` unless you install rsyslog, and Debian 13 has no `lastb`, so use `journalctl` there. > [tab] AlmaLinux / Rocky > > ```bash theme={null} > sudo journalctl -u sshd --since "24 hours ago" | grep -E "Failed password|Invalid user" > sudo grep -E "Failed password|Invalid user" /var/log/secure | tail -n 20 > sudo lastb -i -n 20 > ``` Typical lines: ```text theme={null} Nov 04 13:41:02 server sshd[20811]: Invalid user admin from 198.51.100.41 port 51022 Nov 04 13:41:04 server sshd[20811]: Failed password for invalid user admin from 198.51.100.41 port 51022 ssh2 Nov 04 13:55:17 server sshd[21044]: Accepted publickey for alex from 203.0.113.10 port 50112 ssh2: ED25519 SHA256:… ``` `Invalid user` means the user name does not exist. `Failed password for alex` means someone tried a real user name, which is more serious. ## How to count which IP addresses attack the most ```bash theme={null} sudo journalctl -u ssh --since "24 hours ago" | grep "Failed password" | grep -oE "from [0-9a-f.:]+" | sort | uniq -c | sort -rn | head ``` Use `-u sshd` on AlmaLinux/Rocky. Hundreds of attempts from the internet are normal for any server with SSH open. [Fail2Ban](https://help.freakhosting.com/portals/other/how-to-set-up-fail2ban-for-ssh-on-ubuntu.md) or [CrowdSec](https://help.freakhosting.com/portals/other/how-to-install-crowdsec-on-linux.md) block them automatically, and [disabling password login](https://help.freakhosting.com/portals/other/how-to-disable-password-login-for-ssh.md) makes them useless. ## How to see successful SSH logins only ```bash theme={null} sudo journalctl -u ssh --since "7 days ago" | grep "Accepted" ``` Each line shows the user, source IP and method (`publickey` or `password`). A `password` login when you only use keys, or an IP you do not know, needs action. ## What to do if you find a login you do not recognise 1. Note the user, IP address and time. 2. Check what that user changed: `sudo cat /home/USER/.bash_history` and `sudo ls -la /home/USER/.ssh/`. 3. Follow [what to do if your Linux server is hacked](https://help.freakhosting.com/portals/other/what-to-do-if-your-linux-server-is-hacked.md). ## Frequently asked questions ### Why does journalctl -u ssh show nothing on AlmaLinux? The service is named `sshd` there. Use `journalctl -u sshd`. ### Why is last empty? The login record file may have been rotated, or you are on Debian 13 without `wtmpdb`. Use `last -f /var/log/wtmp.1` for the previous file, or search the journal instead. ### How long are login logs kept? It depends on your log rotation and journal size settings. Check the journal with `journalctl --disk-usage` and see [read logs with journalctl](https://help.freakhosting.com/portals/other/how-to-read-logs-with-journalctl.md). ### Are hundreds of failed logins a sign I have been hacked? No. Bots scan every public IP address for SSH and try common passwords. They are only a problem if a login succeeds, so check the `Accepted` lines. ## Related guides > [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md) > > Every guide in this section. > [card] [Read logs with journalctl](https://help.freakhosting.com/portals/other/how-to-read-logs-with-journalctl.md) > > Filter any service log. > [card] [Set up Fail2Ban](https://help.freakhosting.com/portals/other/how-to-set-up-fail2ban-for-ssh-on-ubuntu.md) > > Ban IPs that keep failing. > [card] [Disable root login](https://help.freakhosting.com/portals/other/how-to-disable-root-login-over-ssh.md) > > Stop direct root logins. > [card] [Server hacked?](https://help.freakhosting.com/portals/other/what-to-do-if-your-linux-server-is-hacked.md) > > Steps to recover safely. *** > [!NOTE] > > **Checked against the [Debian 13 release notes](https://www.debian.org/releases/trixie/release-notes/issues.en.html), the [Debian wtmpdb notes](https://metadata.ftp-master.debian.org/changelogs/main/w/wtmpdb/stable_README.Debian) and the util-linux manuals** on 4 November 2026; `w`, `who`, `last`, `lastb`, `lastlog` and `journalctl` were tested on Ubuntu 24.04 LTS. Commands can differ on other distributions or releases. > [!NOTE] > > ### Need Extra Help? > > If you encounter any issues, our support team is ready to assist: > > * **Live Chat:** Quick assistance via our website. > * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php) > * **Discord:** [Join our Community](https://discord.gg/freakhosting) > * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com) > [!TIP] > > ### Save on Your Hosting > > Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order! *** **Last Updated:** November 2026 This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.