Where are SSH logins logged?

Question

Where are SSH logins logged?

Answer

On RHEL-based systems, the SSH logins are logged to /var/log/secure. On Ubuntu systems, the logins are logged to /var/log/auth.log. If your system is not running the rsyslogd service, you can retrieve the ssh logs from journalctl:

[root@server ~]# journalctl -u sshd
Jan 01 00:00:00 server.hostname.tld sshd[1278831]: Accepted publickey for root from 10.0.0.1 port 53446 ssh2: RSA SHA256:dD>
Jan 01 00:00:00 server.hostname.tld sshd[1278831]: pam_unix(sshd:session): session opened for user root(uid=0) by root(uid=0)

Additional resources

How to filter data from large logs such as /var/log/messages in order to more easily identify problems