aureport

aureport -au --summary

Generates the authentication summary from the auditd log: successful, failed, and per-user, to spot brute force at a glance.

Run it as the first pass of an authentication analysis: aureport -au --summary gives you the system's logon aggregate — how many successful, how many failed, per user — without touching the raw log. The summary answers in seconds 'is there brute force against SSH?' (spike of concentrated failures) and 'which accounts are logging in?' (activity inventory). On hosts without a SIEM or in the first hour of an IR, it's the fastest way to get the host's authentication picture.

Don't use it when you need the detail of a specific event: the summary aggregates and hides the timeline — that's what ausearch is for. And watch out for coverage: aureport only sees what auditd records; if the authentication rule isn't loaded (-a always,exit -F arch=b64 -S execve... or the distro's default rules), the authentication report comes out empty. On high-volume hosts, the summary without a time window mixes days of activity; combine with --start/--end to narrow down. Brute force on services that don't go through audited PAM (some custom services) also won't appear.