Using grep and awk to pull per‑user SSH login failures from /var/log/auth.log into a CSV file

Thu, 17 Sep 2026 11:24:17 +0200

A quick way to see who’s repeatedly failing to log in via SSH is to pull the relevant lines from /var/log/auth.log and turn them into a CSV. The CSV can then be fed into a spreadsheet, a Grafana dashboard, or a simple shell script that alerts you when a user crosses a threshold. Below is a step‑by‑step recipe that uses only grep and awk, two tools that are guaranteed to be present on any modern Linux distribution.

Monitoring on Linux Security

Using grep and awk to pull per‑user SSH login failures from /var/log/auth.log into a CSV file

Using grep and awk to pull per‑user SSH login failures from /var/log/auth.log into a CSV file