Reading Linux Logs: journalctl and auth.log

This guide is for learning. Run these commands only on your own lab or servers.

Logs tell you what your server did and who tried to log in. Reading them is a core defensive skill.

journalctl

journalctl -u ssh --since today
journalctl -p err -b

auth.log

sudo tail -n 50 /var/log/auth.log
sudo grep "Failed password" /var/log/auth.log | wc -l

A large count of failed passwords from many addresses is normal for any public server. It is a good reason to use key login and Fail2ban.

Follow live

sudo tail -f /var/log/auth.log

Logs can hold usernames and addresses. Remove them before you post any screenshot.