Glossary: Attacks and Indicators

/var/log/auth.log

Also written: auth.log

The Linux log file that records logins, SSH sessions and `sudo` use. Analysts search it for failed passwords, invalid users, lockouts, accepted logins and 'user NOT in sudoers' lines to spot password attacks and privilege escalation attempts.