Summarize SSH Auth Outcomes

You need a quick count of successful and failed SSH authentication methods from an auth log.

Command

awk '/sshd/ && /Accepted/ {print "accepted", $7} /sshd/ && /Failed password/ {print "failed", "password"} /sshd/ && /Failed publickey/ {print "failed", "publickey"}' logs/auth.log | sort | uniq -c | sort -nr

Before you run this

Risk: safe. Do not treat this as a full incident timeline; review the matching source lines before making account or firewall changes.

Expected output

A count-sorted summary of accepted public-key logins and failed SSH authentication methods.

System impact

Nothing changes. The command reads the auth log and counts matching SSH authentication outcomes.

Recovery / rollback: no state is changed.

When to use it

Use during SSH access triage when you need a fast read on whether noise is password guessing, stale keys, or real accepted access.

When not to use it

Do not treat this as a full incident timeline; review the matching source lines before making account or firewall changes.

Watch this command run

Example output from a temporary Linux lab

This example uses disposable sample files and sanitized output so you can inspect the shape of the result before touching a real system.

demo@lab:~$

$ grep 'sshd' logs/auth.log

Jun 25 09:58:12 vps sshd[101]: Failed password for invalid user admin from 203.0.113.44 port 50122 ssh2
Jun 25 09:58:18 vps sshd[102]: Failed password for root from 203.0.113.44 port 50124 ssh2
Jun 25 10:01:41 vps sshd[111]: Accepted publickey for alice from 198.51.100.20 port 61422 ssh2: ED25519 SHA256:alicekey
Jun 25 10:03:09 vps sshd[118]: Failed publickey for deploy from 198.51.100.40 port 60210 ssh2: RSA SHA256:olddeploy
Jun 25 10:04:22 vps sshd[121]: Accepted publickey for deploy from 198.51.100.21 port 60444 ssh2: ED25519 SHA256:deploykey
Jun 25 10:05:01 vps sshd[130]: Failed password for bob from 198.51.100.55 port 61200 ssh2
Jun 25 10:05:03 vps sshd[130]: Connection closed by authenticating user bob 198.51.100.55 port 61200 [preauth]

$ awk '/sshd/ && /Accepted/ {print "accepted", $7} /sshd/ && /Failed password/ {print "failed", "password"} /sshd/ && /Failed publickey/ {print "failed", "publickey"}' logs/auth.log | sort | uniq -c | sort -nr

      3 failed password
      2 accepted publickey
      1 failed publickey

View reproducible demo details

This page shows the sanitized shell transcript and the setup steps needed to reproduce the example.