Short one that I've been unable to find a decent answer for.

Centos 5.10 server, trying to trawl through all the logs I can to see what IPs successfully accessed the server. I've been mucking about with /var/log/secure and /var/log/audit/audit.log.

Most interesting thing I found was from the /root/.bash_history, grepping through a few suspect directories and files for a specific IP but I want to be sure exactly what IPs have accessed the server via ssh.


Does /var/log/secure log ssh successes or is there some other file on centos systems that do?

  • 4
    welcome to Stack Exchange! on Stack Exchange, we expect people to do a basic level of research before they come to us, given that we're all volunteers. so with that in mind: try it. access the server yourself and see if your IP gets logged.
    – strugee
    Apr 11, 2014 at 6:43
  • It's just the 'success' but at the end I'm not sure about and was hence wondering if either of them log successful ssh connections (or aren't in this case because of config?)
    – Nom
    Apr 11, 2014 at 23:04

3 Answers 3


You're looking to grep for "Accepted", not something in the lines of "Success-"

grep Accepted /var/log/secure

Since logging is configurable, you will need to check your syslog configuration to figure out exactly what gets logged to where.

  • Any ideas where exactly to check or what to configure?
    – Nom
    Apr 11, 2014 at 22:58
  • That depends on what syslog program you're using. Please don't take this the wrong way, but I strongly advice you to read the documentation at centos.org/docs/5/html/5.2/Deployment_Guide - there's a section specifically about locating log files, and you really need to know the basics about how the system works.
    – Jenny D
    Apr 12, 2014 at 19:19

/var/log/auth.log logs successful and failed connection attempts. You should check that file.

  • 2
    There is no /var/log/auth on redhat/centos systems.
    – Nom
    Apr 11, 2014 at 22:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .