I tried to view failed user login attempts since a specific time. But all methods I found by searching the internet does not work. I am using openSUSE 13.2.journalctl -a --no-pager --since=2015-02-04 00:00:00gives me a long and ugly list of all system events (also with the failed login attempts). Is there a better way to collect these informations?
how to view failed login attempts?
users;sshd
This works for me:journalctl `which sshd` -a --no-pager --since=2015-02-04 00:00:00 | grep FailedSample output:Apr 02 10:18:13 sturm sshd[6068]: Failed password for aboettger from 192.168.2.40 port 4812 ssh2Apr 02 10:18:18 sturm sshd[6068]: Failed password for aboettger from 192.168.2.40 port 4812 ssh2Or use the -p-Option, eg.:journalctl `which sshd` -p 5 -a --no-pager --since=2015-02-04 00:00:00journalctl man page:   -p, --priority=       Filter output by message priorities or priority ranges. Takes either a single numeric or textual log level (i.e. between       0/emerg and 7/debug), or a range of numeric/text log levels in the form FROM..TO. The log levels are the usual syslog       log levels as documented in syslog(3), i.e.  emerg (0), alert (1), crit (2), err (3), warning (4), notice (5),       info (6), debug (7). If a single log level is specified, all messages with this log level or a lower (hence more       important) log level are shown. If a range is specified, all messages within the range are shown, including both the start       and the end value of the range. This will add PRIORITY= matches for the specified priorities.