Thousands of failed logins in auth.log and no idea what matters? Paste it below: who attacked, what usernames they tried, and - the question that counts - whether anyone actually got in.
Parsed entirely in your browser - the log never leaves your machine. Only the bare IPs of top attackers are sent to our reputation API (and you can skip that below).
The failed-attempt volume is mostly internet background noise - every public SSH port gets scanned constantly, and with password auth disabled it's harmless. Three things in the output deserve real attention: accepted logins you don't recognise (especially close in time to a burst of failures from the same address), an attacker trying your actual usernames rather than the generic admin/test/oracle rotation (they know something about you), and failures arriving in a low-and-slow trickle from many addresses (a distributed attempt designed to stay under fail2ban thresholds).
Where to get the log: Debian/Ubuntu keep it at /var/log/auth.log; RHEL-family at /var/log/secure; systemd-only hosts use journalctl -u ssh -u sshd --since "-7 days" > auth.log. If you find an accepted login you can't explain, go straight to the compromise-check runbook.
AlertKick's agent sees every SSH login at the kernel as it happens - correlated with threat feeds and what ran afterwards, triaged by AI, and alerting you only when it matters. The forensic dig above becomes a push notification.
Watch my SSH logins - free