AuthLog Watch

Small, read-only Linux authentication-log triage for defenders, SOC analysts, and IT administrators.

The problem

SSH brute-force attempts and suspicious authentication activity are easy to miss in a busy auth.log. AuthLog Watch summarizes the log locally and highlights repeated failures without changing the system or sending data anywhere.

What it detects

• Repeated SSH password failures by source IP
• Invalid-user scans
• Repeated sudo authentication failures
• Successful SSH logins for quick review
• Text or JSON output for incident notes and automation

Quick start

python3 authlog_watch.py sample_auth.log
python3 authlog_watch.py /var/log/auth.log --threshold 5 --json > report.json
python3 authlog_watch.py /var/log/secure --threshold 3

The tool only reads the file you provide. It does not block IPs, edit firewall rules, delete logs, or transmit data.

Example output

Analyzed 8 lines
SSH failures: 5
Successful SSH logins: 1
Findings: 2
[HIGH] ssh_brute_force: 203.0.113.50 (5)
[MEDIUM] invalid_user_scan: 203.0.113.50 (1)

Exit codes

• 0: no high-severity finding
• 1: high-severity finding detected
• 2: input or usage error

This makes it suitable for a scheduled check or CI smoke test. A high finding is a signal to investigate, not proof of compromise.

Why this matters

A small, explainable first-pass report helps an administrator notice repeated authentication abuse quickly while keeping the original log intact for proper investigation.

Safety notes

Use only on systems and logs you are authorized to inspect. The sample uses documentation-only IP ranges from RFC 5737.

License

MIT. See LICENSE.