How to Monitor Failed Login Attempts

Method 1: Using Lastb Command

lastb | head -20

Method 2: Count Failed Attempts

sudo grep "Failed password" /var/log/auth.log | wc -l

Method 3: Show Failed Attempts by IP

sudo grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -nr

Method 4: Real-Time Monitoring

sudo tail -f /var/log/auth.log | grep "Failed password"