16 entries

Linux syslog

SSH, sudo, and PAM messages from /var/log/auth.log and journald.

Accepted password Accepted password: an SSH login succeeded Worth a look Someone signed in over SSH successfully. Routine on its own — but a success from an address that was failing moments earlier is the single most important line in an auth log, and it is the thing worth alerting on.
authentication failure Authentication failure: a sudo or su attempt was rejected Worth a look Someone tried to escalate privileges and gave the wrong password, or tried to use sudo without permission. A typo looks identical to a probe — the difference is who the account is and whether they were entitled to escalate at all.
blk_update_request: I/O error blk_update_request: a read or write to a disk failed Act now The kernel asked a block device for a sector and did not get it. This is the lowest-level storage failure Linux reports, below any filesystem — so it is real, it is not a software bug, and the only question left is whether the drive, the cable, or the layer beneath it is at fault.
CMD CRON CMD: a scheduled job ran Informational cron ran a scheduled command. The log records that it started, and almost never whether it worked — which is why cron failures are so often discovered late, and why an attacker's cron entry is easy to miss.
COMMAND sudo: a command was run as another user Worth a look Someone used sudo to run a command as root or another account, and the log recorded exactly which command. It is the clearest record of privileged activity on a Linux system — and one that is trivially bypassed once a user has a root shell.
Connection closed [preauth] SSH: connection closed before authentication finished Informational A connection reached the SSH server and went away before anyone logged in. The [preauth] marker is the important part: it means no authentication completed, so nobody got in. On an internet-facing server these are the single most common lines in the auth log.
Failed password Failed password: an SSH login was rejected Worth a look Someone tried to sign in over SSH with the wrong password. On any server reachable from the internet these arrive constantly — automated scanning, not a targeted attack. What matters is whether one ever succeeded.
Failed to start Failed to start: a systemd service did not come up Worth a look systemd tried to start a service and it did not stay running. The line itself only says which unit failed — the reason is in the exit status and the unit's own log, and reading those in the right order turns a vague failure into a specific one.
Invalid user Invalid user: an SSH login for an account that does not exist Informational Someone tried to sign in with a username the system has never heard of. It is the clearest possible signal of untargeted scanning, because the usernames come straight from public wordlists rather than from anything about your organisation.
logrotate exited abnormally logrotate failed, and your disk is now filling up Investigate Log rotation stopped working. Nothing breaks at the moment it fails — the consequence arrives weeks later when a partition fills and takes services down with it. That delay is why this quiet cron message is worth acting on the day it appears.
martian source Kernel: martian source — a packet arrived from the wrong direction Worth a look The kernel received a packet whose source address could not legitimately have come from that interface, and dropped it. The name is old networking slang for an address from nowhere. It is usually a routing mistake on your own network, not an attack.
maximum authentication attempts exceeded SSH: maximum authentication attempts exceeded Worth a look The SSH server cut a connection off after too many authentication attempts. The surprise is how often this happens to legitimate users who typed nothing wrong: an SSH client offers every key it has, one at a time, and each offer counts as an attempt.
NOTICE [jail] Ban fail2ban: an address was banned Informational fail2ban read enough failed attempts from one address in its time window and inserted a firewall rule to drop it. The ban is temporary by design, and the log line tells you which jail decided — which is more informative than the address itself.
Out of memory: Killed process Out of memory: the kernel killed a process to stay alive Act now Linux ran out of memory and picked something to kill. It does not kill whatever caused the problem — it kills whatever scores highest, which is usually the largest process. That is why the database dies when a backup script leaks memory.
pam_unix authentication failure pam_unix authentication failure: a login was rejected Worth a look The PAM authentication layer refused a login. Because nearly every Linux login path goes through PAM, these messages cover SSH, sudo, su, console logins, and services alike — and the service name in brackets tells you which.
session opened for user root by su: someone switched to another account successfully Worth a look A user became another account, usually root. The line records who did it and when — and then stops. Unlike sudo, which logs every command, su hands over a shell and everything that happens afterwards is attributed to the target account with no further record.