# Check SSH Brute-Force Login Attempts

> Terminal commands to count and monitor failed SSH logins on Linux

This tip provides quick Linux shell commands to inspect authentication logs for unauthorized access attempts. Running grep on the system auth log tallies failed password attempts, while tail lets administrators watch incoming connection attempts in real time.

## How it works

Run the following command to count failed password attempts in your authentication logs:

grep "Failed password" /var/log/auth.log \| wc -l

To monitor incoming login attempts in real time, run:

tail -f /var/log/auth.log

## What it is for

- Count the total number of failed SSH login attempts on a Linux VPS
- Monitor live authentication logs to detect brute-force attacks as they happen
- Verify whether additional server hardening tools like Fail2ban are needed

## Key points

- Run grep "Failed password" /var/log/auth.log \| wc -l to count failed password attempts
- Run tail -f /var/log/auth.log to stream authentication log events in real time
- Works natively on standard Debian and Ubuntu systems without extra software

## Pricing

Free

## Details

- Type: Tip
- Category: [Development](https://xiry.app/topics/development.md)
- Topic: [Server Security](https://xiry.app/topics/development/server-security.md)
- Open source: yes
- Platforms: Linux, Command line
- For: Linux system administrators and VPS owners
- Tags: linux, ssh, sysadmin, security, bash, terminal

## Why it was saved

- [@brusnicadev, 16 August 2026](https://www.instagram.com/reel/DcGacI2D1gF/): Quickly inspects how many unauthorized login and brute-force attempts targeted your public server in recent logs.

## Related

- [CrowdSec](https://xiry.app/resources/crowdsec): Open-source collaborative security engine and intrusion prevention system using crowdsourced threat data. (GitHub repo, Open source)
- [endlessh-go](https://xiry.app/resources/endlessh-go): SSH tarpit written in Go with built-in Prometheus metrics and Grafana support (GitHub repo, Open source)
- [Fail2Ban](https://xiry.app/resources/fail2ban): Log-monitoring daemon that dynamically blocks IP addresses causing repeated authentication failures. (GitHub repo, Open source)
- [SSH Brute-Force Protection with fail2ban and ufw](https://xiry.app/resources/ssh-brute-force-protection-with-fail2ban-and-ufw): Quick commands to detect and block SSH brute-force attacks on Linux (Tip, Free)
- [Kisuke](https://xiry.app/resources/kisuke): Mobile and cross-platform IDE with terminal, browser devtools, and AI agents. (Mobile app, Free)
- [Google Antigravity](https://xiry.app/resources/google-antigravity): Agentic development platform and IDE for running autonomous coding agents. (Desktop app, Freemium)

Updated 3 October 2026. Page: https://xiry.app/resources/check-ssh-brute-force-login-attempts

Make your own library: Xiry takes your saved reels, tweets, Reddit bookmarks and Watch Later videos, makes them searchable and pulls the useful stuff out, like this library. It's invite-only for now; join the waitlist at https://xiry.app/#waitlist.