Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Solaris machine ( Solaris 10 )

Is it possible to see from my machine ( logs ) which machines are try to connect to my machine by SSH?

share|improve this question
up vote 2 down vote accepted

On a Solaris 10 system I have to hand ssh connections (and other auth related information) are logged to



Oct 10 15:15:46 solbase sshd[1481]: [ID 800047] Accepted publickey for iain from port 52197 ssh2

is a connection by me to a Solaris 10 machine and

Oct 10 15:17:33 solbase sshd[1481]: [ID 800047] Received disconnect from 11: disconnected by user

is a disconnect from the same machine.

share|improve this answer
Lucky Iain, not being stuck in the late '90s like me! Upvote for you! – MadHatter Oct 10 '12 at 14:29

Yes. Assuming your logs are set up reasonably standardly (and that Sun hasn't been varying things gratuitously), you should see something much like these logs, which are from /var/log/secure on a Solaris 8 box that I have handy:

A successful login (using a public key rather than a password):

Oct 10 15:09:15 xxxx sshd[22706]: [ID 800047] Accepted publickey for myuser from port 56035 ssh2

A failed attempt:

Oct 10 15:09:27 xxxx sshd[22726]: [ID 800047] Illegal user fred from
Oct 10 15:09:27 xxxx sshd[22726]: [ID 800047] Failed none for illegal user fred from port 56036 ssh2
Oct 10 15:09:28 xxxx sshd[22726]: [ID 800047 auth.error] error: Could not get shadow information for NOUSER
Oct 10 15:09:28 xxxx sshd[22726]: [ID 800047] Failed password for illegal user fred from port 56036 ssh2
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.