Reviewing System Logs for Suspicious Activity

Regularly checking your server's logs can help you spot security issues before they become major problems.

Key Log Files

• /var/log/auth.log (Ubuntu/Debian) or /var/log/secure (CentOS/AlmaLinux): Records all authentication attempts, including successful and failed SSH logins.
• /var/log/syslog (or /var/log/messages): General system activity logs.
• Web server logs (e.g., /var/log/nginx/access.log): Shows who is accessing your website.

Useful Commands

# View the last 100 lines of the auth log
sudo tail -n 100 /var/log/auth.log

# Search for all failed password attempts
sudo grep "Failed password" /var/log/auth.log

# Watch a log file in real-time
sudo tail -f /var/log/nginx/access.log