Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I wrote a bash command to scan /var/log/auth.log for messages occurring on the current day indicating unauthorised access. Currently it just fetches messages matching BREAK-IN and unauthorized.

What other strings should I search for in /var/log/auth.log to keep tabs on unauthorized access?

Here's the script for reference:

cat /var/log/auth.log|grep "$(date|awk '{print $2" "$3}')"|grep -E '(BREAK-IN|Invalid user|Failed|refused|su|Illegal)'


Here's the amended command based on Justins suggestions and what I found through Google

grep "$(date|awk '{print $2" "$3}')" /var/log/auth.log|grep -E '(BREAK-IN|Invalid user|Failed|refused|su|Illegal)'
share|improve this question
up vote 2 down vote accepted

You could look for "Invalid user" which is thrown when someone tries to logon with an account that does not exist. It will also throw up "Failed password" when you enter in an invalid password.

Also, you dont need to use cat to dump the file to grep. Grep can already look at the file as its second option. 'Grep search-criteria /path/tp/file'

share|improve this answer
Thanks Justin, I had googled some answers actually and have amended the last grep string accordingly. Thanks for the tip on cat, it's obviously time for bed ;o) – conorgriffin Oct 16 '10 at 1:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.