auth.log grep

grep -i 'authentication failure' /var/log/auth.log

Extract all authentication failures from auth.log, the direct signal of brute force and sprays against host services.

Run it as the first authentication sweep on any Linux host: auth.log concentrates PAM, SSH, sudo, and login events, and the failure filter gives you the list of failed attempts with user, service, and origin. It's the fastest manual detection of SSH brute force (thousands of root failures from external IPs) and internal sprays (failures spread across accounts from a single IP). On hosts without SIEM or auditd, it's the only authentication source left, and grep is the first step of any IR.

Don't use it on hosts with journald and without /var/log/auth.log (modern distros with minimized rsyslog): the file doesn't exist and you need to go to journalctl. Simple grep falls short for correlations — to group by IP or user you need awk or analysis tools. And watch out for volume: on internet-exposed hosts, auth.log accumulates thousands of failures per day; grep without a time filter mixes everything. Brute force that doesn't go through PAM (services with their own authentication: MySQL, Redis, web apps) doesn't appear here — those failures live in the service logs.