grep "Failed password" /var/log/auth.log
cat /var/log/auth.log | grep "Failed password"In CentOS or RHEL, the failed SSH sessions are recorded in /var/log/secure file. Issue the above command against this log file to identify failed SSH logins.
egrep "Failed|Failure" /var/log/auth.logA slightly modified version of the above command to display failed SSH logins in CentOS or RHEL is as follows.
# grep "Failed" /var/log/secure
# grep "authentication failure" /var/log/secure
