8 entries

Linux syslog

SSH, sudo, and PAM messages from /var/log/auth.log and journald.

Accepted password Accepted password: an SSH login succeeded Worth a look Someone signed in over SSH successfully. Routine on its own — but a success from an address that was failing moments earlier is the single most important line in an auth log, and it is the thing worth alerting on.
authentication failure Authentication failure: a sudo or su attempt was rejected Worth a look Someone tried to escalate privileges and gave the wrong password, or tried to use sudo without permission. A typo looks identical to a probe — the difference is who the account is and whether they were entitled to escalate at all.
CMD CRON CMD: a scheduled job ran Informational cron ran a scheduled command. The log records that it started, and almost never whether it worked — which is why cron failures are so often discovered late, and why an attacker's cron entry is easy to miss.
COMMAND sudo: a command was run as another user Worth a look Someone used sudo to run a command as root or another account, and the log recorded exactly which command. It is the clearest record of privileged activity on a Linux system — and one that is trivially bypassed once a user has a root shell.
Failed password Failed password: an SSH login was rejected Worth a look Someone tried to sign in over SSH with the wrong password. On any server reachable from the internet these arrive constantly — automated scanning, not a targeted attack. What matters is whether one ever succeeded.
Failed to start Failed to start: a systemd service did not come up Worth a look systemd tried to start a service and it did not stay running. The line itself only says which unit failed — the reason is in the exit status and the unit's own log, and reading those in the right order turns a vague failure into a specific one.
Invalid user Invalid user: an SSH login for an account that does not exist Informational Someone tried to sign in with a username the system has never heard of. It is the clearest possible signal of untargeted scanning, because the usernames come straight from public wordlists rather than from anything about your organisation.
pam_unix authentication failure pam_unix authentication failure: a login was rejected Worth a look The PAM authentication layer refused a login. Because nearly every Linux login path goes through PAM, these messages cover SSH, sudo, su, console logins, and services alike — and the service name in brackets tells you which.