0

I tried to view failed user login attempts since a specific time. But all methods I found by searching the internet does not work. I am using openSUSE 13.2.

journalctl -a --no-pager --since="2015-02-04 00:00:00"

gives me a long and ugly list of all system events (also with the failed login attempts). Is there a better way to collect these informations?

0

This works for me:

journalctl `which sshd` -a --no-pager --since="2015-02-04 00:00:00" | grep Failed

Sample output:

Apr 02 10:18:13 sturm sshd[6068]: Failed password for aboettger from 192.168.2.40 port 4812 ssh2
Apr 02 10:18:18 sturm sshd[6068]: Failed password for aboettger from 192.168.2.40 port 4812 ssh2

Or use the -p-Option, eg.:

journalctl `which sshd` -p 5 -a --no-pager --since="2015-02-04 00:00:00"

journalctl man page:

   -p, --priority=
       Filter output by message priorities or priority ranges. Takes either a single numeric or textual log level (i.e. between
       0/"emerg" and 7/"debug"), or a range of numeric/text log levels in the form FROM..TO. The log levels are the usual syslog
       log levels as documented in syslog(3), i.e.  "emerg" (0), "alert" (1), "crit" (2), "err" (3), "warning" (4), "notice" (5),
       "info" (6), "debug" (7). If a single log level is specified, all messages with this log level or a lower (hence more
       important) log level are shown. If a range is specified, all messages within the range are shown, including both the start
       and the end value of the range. This will add "PRIORITY=" matches for the specified priorities.
  • thanks, that was what I am searching for. But what means e. g. like this error message: Feb 04 00:23:05 renamed-gaming sshd[11146]: Failed keyboard-interactive/pam for invalid user manager from 94.79.33.21 port 14159 ssh2 – alpham8 Apr 2 '15 at 17:48
  • For this, you should create a new question. – A.B. Apr 2 '15 at 17:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.