Auth.log

Debug logs are located in different files depending on distro:

• /var/log/auth.log (Debian/Ubuntu) – Logs authentication attempts, failures, and SSH errors.
• /var/log/secure (RHEL/CentOS) – Logs authentication and security-related events.
• /var/log/audit/audit.log – If SELinux blocks an SSH login attempt or key access, it logs denials.

For real-time debug logs:

tail -f /var/log/secure    Copy

For last 50 logs:

tail -n 50 /var/log/secure    Copy

For systemd-based distros (Ubuntu, CentOS, etc.):

journalctl -u sshd -n 50   Copy

Find unauthorized sudo attempts:

grep "sudo:" /var/log/auth.log | grep "authentication failure"   Copy