SSH & auth log analyzer

What this analyzer looks for

Brute force against SSH is constant background noise on any public host, so a long list of failed passwords is not by itself news. What matters is the transition: a source address that failed repeatedly and then succeeded. That single pattern is the difference between "the internet is knocking" and "someone is inside", and it is the first thing this tool reports.

Around it: which usernames are being targeted, whether root may be logged into directly, how much of your successful authentication uses passwords rather than keys, which accounts escalate through sudo, and whether any account or group was created during the window.

Limits worth knowing

Syslog lines do not record a year, so dates are inferred. A log that straddles New Year, or one older than a year, can be misdated — check the first and last timestamps shown before drawing conclusions from them.

A successful login following failures is a signal, not proof. The same address legitimately produces that pattern when a person mistypes a password and then gets it right, or when several people share one NAT address. Confirm against the account owner before treating it as an incident.

Privacy

Logs routinely contain personal data, internal hostnames, usernames and sometimes credentials. Files and pasted text are processed entirely in your browser and are never sent to QCRAMAI. Review and redact before sharing any exported output. Each analysis is limited to 200,000 non-empty lines and files to 25 MB.