Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Under CentOS, I need a script that will run every 10 minutes and e-mail me if there are any new failed ssh login attempts in /var/log/secure.

share|improve this question
Just my thoughts; This would be a bad idea if this is on a public facing machine that allows anyone to connect to SSH. You will be swamped with emails due to automated attacks. – jwbensley Jan 25 '12 at 11:30

Why not considering to use fail2ban or SSHGuard. Fail2ban seems configurable to send emails. These are better than any script written within 5 or 10 minutes.

Also, such solutions can protect you other than just sending emails.

share|improve this answer

You could use Logcheck for "analysing" specific logs and it sends periodically emails to you. Of course, some configuration is necessary. On Debian systems installed via aptitude install logcheck it checks /var/log/syslog and /var/log/auth.log per default. But adding other logs and configuration the search strings via RegEx (?) is kind of easy.

Please read the notice on the download page:

Note: For installation on platforms other than Debian, download the latest tarball using the source package links found on the logcheck package page

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.