Skip to content
ServerPilot

SSH activity logs

The SSH activity log contains records of all SSH login attempts as well as the start and end times of SSH sessions.

View the logs

A server’s SSH activity logs can be viewed from within the ServerPilot dashboard or through SSH.

Log file location

The SSH activity log is located at:

/var/log/auth.log

Log file format

The format of each entry in the SSH activity log is:

DATE_TIME HOSTNAME SERVICE[PROCESS_ID]: LOG_MESSAGE

The following example shows log entries from a successful SSH login as root that used public key authentication.

2025-03-07T15:36:18.567155+00:00 example-server sshd[2491798]: Accepted publickey for root from 203.0.113.0 port 65350 ssh2: RSA SHA256:XaeoOmXzt2fEF67opjDlcTRDUiFksXVXKxCAJSSwzch
2025-03-07T15:36:18.577133+00:00 example-server sshd[2491798]: pam_unix(sshd:session): session opened for user root(uid=0) by root(uid=0)
2025-03-07T15:36:18.630644+00:00 example-server systemd-logind[808]: New session 36872 of user root.

The fields in each log entry are described in the following table.

FieldDescription
DATE_TIMEThe date and time of the log entry.
HOSTNAMEThe server’s hostname.
SERVICEThe service that generated the log entry.
PROCESS_IDThe process ID that generated the log entry.
LOG_MESSAGEThe log message content.

Example commands

You must be logged in as root to view the SSH activity log.

View recent SSH activity log entries

Show the most recent 100 lines in the SSH activity log.

Terminal window
sudo tail -n 100 /var/log/auth.log