SSH log messages: what each sshd line means
Any server with port 22 open logs a steady stream of Invalid user,
[preauth] and pam_unix lines. These pages explain
each one for the person reading the log: what produced it, whether it is an attack or noise, and the command that
answers the next question.
The counts are real: LogTriage's production API server (Hetzner, Germany): port 22 open to the internet, key-only since 6 October 2026 (password and keyboard-interactive authentication off); nginx in front of the API on ports 80 and 443. In the 30 days to 25 October 2026 its sshd journal held 518,275 lines, including 79,653 failed password attempts from 1,505 addresses. Every format string is quoted from the OpenSSH 10.2p1 and Linux-PAM 1.7.0 source, with a link to the exact line.
Examples: Matched in your browser — nothing is sent anywhere.
All messages, most frequent first
| Log line | What it means | Our server, 30 days | Triage |
|---|---|---|---|
| Connection closed by … | The client at the other end of the SSH connection went away — closed it cleanly, or reset it — and sshd logged the address, port and (if the client had already named an account) the user it was trying before it quit. | 99,159 | low |
| … for … from … port … ssh2… | sshd rejected a password authentication attempt — the line names the account that was tried, the client address and the client's source port, and marks names that are not usable accounts on this host with "invalid user". | 79,653 | low |
| Invalid user … from … port … | sshd rejected the login because the name the client asked for is not a valid account on this host, so no password or key was ever checked against a real user. | 72,194 | low |
| authentication failure; logname=… uid=… euid=… tty=… ruser=… rhost=… | PAM's pam_unix module rejected the credentials sshd asked it to check — the line names the client address in rhost= and, when it has one, the account in user=. | 72,136 | low |
| check pass; user unknown | pam_unix was asked to check a password for a name it has no account record for, so the attempt failed before any password was compared — and the line deliberately leaves out both the name and the source address. | 48,083 | low |
| Received disconnect from … port …:…: … | The client told the server it was closing the connection — sshd logged the client's address and port, the numeric disconnect reason the client sent and the text that came with it. | 26,084 | low |
| Disconnected from … | The client told sshd which account it wanted and then ended the connection before authentication succeeded, so the line names that account along with the source address and port. | 26,063 | low |
| password check failed for user (…) | PAM's password helper checked the password offered for the named account and it did not pass — a wrong password, or a name it could not resolve — and the line itself carries no address, so the sshd lines beside it are what tell you where it came from. | 24,907 | low |
| … for … from … port … ssh2… | sshd authenticated the named account — the line records a completed SSH login with the method used, the user, the client address and source port, and for public keys the key type and fingerprint that was accepted. | 19,863 | informational |
| … more authentication failure…; logname=… uid=… euid=… tty=… ruser=… rhost=… | pam_unix's end-of-connection tally of repeated password failures — the number printed is one less than the failures it counted, and the companion line fires when that count passes the module's compiled-in limit of 3. | 3,803 | low |
| Timeout before authentication for …, pid = … | A connection was accepted but did not finish authenticating inside the login grace period, so sshd terminated the pre-authentication process and the listener logged the client and that process's pid. | 2,566 | low |
| maximum authentication attempts exceeded for … from … port … ssh2 | One SSH connection used up every authentication attempt sshd allows it — the MaxAuthTries limit, 6 by default — so sshd logged the account name, source address and port and tore the connection down. | 582 | medium |
| …: activating … penalty of … seconds for … | sshd has accumulated enough penalty against one client address range to start refusing its connections, and the line names the address, the number of seconds left on the block and what the client did to earn it. | 403 | low |
| kex_exchange_identification(struct ssh *ssh, int timeout_ms, | sshd never finished the opening banner exchange with the client — the other end went away (or sent something unreadable) before sending its identification string, so the connection ended before key exchange and before any authentication. | 353 | informational |
| Unable to negotiate with …: …. Their offer: … | The client and the server had no key exchange method, host key type, cipher or MAC in common, so sshd logged what the client offered and ended the connection before any account was named. | 321 | low |
| …Connection … | sshd dropped the connection during the opening protocol banner exchange because what the client sent could not be parsed — almost always something that is not an SSH client at all. | 306 | low |
SSH journal coverage: 30 days. Counts refresh weekly.
Have a whole auth.log to read?
The free browser analyzer reads /var/log/auth.log and journalctl output, groups failures by source and account, and flags brute force, password spraying and a success after failures — each line linked back to these pages. Nothing is uploaded.