Skip to content
LinuxSystemCritical

Linux Auth Log

Authentication and authorization events emitted by PAM-aware services — sshd logins, sudo invocations, su attempts, screen unlocks, and polkit decisions. The first place to look when scoping a Linux compromise.

artifact_type: linux_auth_log

Where to find it

Default filesystem paths and registry locations. Collect these with your preferred live-response or disk-image tooling.

  • $/var/log/auth.log
  • $/var/log/secure
  • $/var/log/auth.log.1
  • $/var/log/auth.log.*.gz

Forensic significance

Common scenarios in which this artifact becomes decisive evidence.

  • SSH brute-force and password spray detection
  • Mapping every sudo command to a real user and TTY
  • Identifying lateral movement via accepted public-key authentications
  • Detecting privilege abuse — sudo to root from non-admin accounts

MITRE ATT&CK mapping

Techniques this artifact can help detect or substantiate. Click a technique to view the official MITRE entry.

Tools that parse it

unJaena AI and other DFIR tools commonly used to extract evidence from this artifact.

unJaena AI
Plaso (log2timeline)
fail2ban
OSSEC
grep

Related artifacts

References & further reading

Stop parsing artifacts by hand

unJaena AI ingests disk images, live-response output, and mobile backups, then automatically correlates every artifact on this page — and 200+ more — into an investigator-ready timeline.

Try unJaena AI