Server logs and login auditing

Logs answer three questions: what broke, who logged in to the server and what they did there. You only get an answer if logging is enabled, the logs are kept long enough and they are not stored only on the server that may have been compromised. Here is where to find logs on Linux, which commands show logins, how to set up rotation and what to do in advance so that there is something to investigate after an incident.

Updated 07.11.2026 · Find a VPS for your needs →

On a Linux system with systemd, two services write logs. journald, part of systemd, collects messages from all services, the kernel and logins into a binary journal. rsyslog, if installed, sorts the same messages into text files under /var/log. The web server, the database and Docker keep their own logs. You need to know where everything is before an incident, not during one.

Where the logs are

  • journald. Read it with journalctl. The journal is kept on disk if the /var/log/journal directory exists; otherwise it is kept only in memory and lost on reboot (journald.conf, the Storage=auto setting). Check this on a new server with ls /var/log/journal. If the directory is missing, create it and restart the service: systemctl restart systemd-journald.
  • System files. On Ubuntu, logins and sudo are written to /var/log/auth.log and general messages to /var/log/syslog. On AlmaLinux and Rocky Linux these are /var/log/secure and /var/log/messages. Debian 12 and later do not install rsyslog by default, so everything is only in journald.
  • The web server. nginx writes to /var/log/nginx/access.log and error.log; Apache writes to /var/log/apache2/ on Debian and Ubuntu or /var/log/httpd/ on AlmaLinux. The access log records every request: address, time, path, response code, size and browser. The set of fields is defined by the log_format directive. If the site sits behind a CDN, configure the server to pass on the visitor's real address, or the log will contain only CDN addresses (more in the article CDN: when a website needs one).
  • Applications and Docker. Databases write to their own directories under /var/log, and containers write to Docker's files, which you read with docker logs.

A few journalctl commands cover most cases: journalctl -u nginx --since "1 hour ago" shows one service's messages for the last hour; journalctl -p err -b shows errors since the last boot; journalctl -f follows new messages; journalctl --disk-usage shows how much space the journal takes.

Who logged in to the server

Every SSH login leaves a record with the user name, the address and the authentication method, key or password. To see successful logins:

  • in journald: journalctl -u ssh --since today | grep Accepted (on AlmaLinux the service is called sshd);
  • in a file: grep Accepted /var/log/auth.log or /var/log/secure;
  • as a summary: last shows logins and reboots, lastb shows failed attempts.

Debian 13 no longer ships last, lastb and lastlog: their old file formats cannot store dates after 2038. The wtmpdb and lastlog2 packages replace them (Debian 13 release notes). The Accepted entries in the journal remain in every version.

What to look for. Logins from unfamiliar addresses and at unusual times. Password logins when you have configured key-only access: that means the setting did not take effect. Commands run with sudo: auth.log and journald record who ran what. New keys in ~/.ssh/authorized_keys and new users in /etc/passwd: intruders add them to get back in later. If you need a detailed audit of file changes and commands, Linux has the auditd audit subsystem, but its rules need separate configuration and disk space.

fail2ban: what it offers beyond SSH

fail2ban reads logs and temporarily blocks addresses that fail to log in again and again. Installing it and protecting SSH is covered in the article First 10 steps after buying a VPS: security. By default an address is blocked for 10 minutes after 5 failures within 10 minutes (jail.conf). What is worth adding:

  • Long bans for repeat offenders. The recidive jail reads fail2ban's own log and blocks for a week any address that was banned several times within a day. The bantime.increment = true setting doubles the ban with each new one.
  • Web server jails. The ready-made nginx-http-auth, nginx-limit-req and nginx-botsearch jails react to wrong passwords on protected pages, exceeded request rate limits and scanning for non-existent URLs.
  • Your own addresses as exceptions. The ignoreip setting with your office's static address keeps you from locking yourself out.

fail2ban does not protect against distributed attacks from thousands of addresses and does not replace key-based login. Its main value for auditing is a shorter log: what remains are meaningful events rather than tens of thousands of identical password-guessing attempts. fail2ban-client status sshd lists the blocked addresses.

Rotation and disk space

Logs grow all the time, and inexpensive VPS plans have small disks. According to the accsly.io catalog as of November 2026, the median disk on VPS plans with 1 GB of memory is 20 GB, and 9% of VPS plans have a disk of 20 GB or less. The access log of a busy site or a container writing an error in a loop fills such a disk within days, after which the database and the site itself stop working.

  • journald by default takes no more than 10% of the file system and no more than 4 GB. Set your own limit with SystemMaxUse= in /etc/systemd/journald.conf and a retention period with MaxRetentionSec=, which is off by default. To free space once: journalctl --vacuum-size=500M or --vacuum-time=30d.
  • Text files are rotated by logrotate according to the rules in /etc/logrotate.d/. On Ubuntu 24.04, system logs are rotated weekly and 4 old files are kept, which is about a month. The nginx logs from the AlmaLinux 9 package are rotated daily with 10 old files kept. The rotate, daily or weekly, compress and maxsize options change the retention, compression and size-based rotation. The copytruncate mode suits programs that cannot reopen their log file, but according to the documentation it may lose lines. To test a rule without changing anything: logrotate -d /etc/logrotate.d/nginx.
  • Docker by default writes container logs with no size limit (json-file driver). Set max-size and max-file in /etc/docker/daemon.json and recreate the containers: the settings apply only to new ones. More in the article Docker on a VPS: getting started.

To find what filled the disk, df -h shows the full partition and du -xh /var/log | sort -h | tail the largest directories. Do not delete a log file that a service keeps open: the space will not be freed until the service restarts. Empty it with truncate -s 0 instead. It is better to get a warning before the disk fills up; that is covered in the article Server monitoring: uptime, load, alerts.

Keeping logs for incident review

If a server is compromised, the first thing an intruder with root access does is edit or delete the logs. That is why a copy that leaves the server immediately is worth more than any retention settings on the server itself.

  1. Ship logs to another server. rsyslog can forward messages over the network, and journald has the systemd-journal-upload service for this. The receiving end can be a separate inexpensive VPS with a larger disk or a log collection system such as Loki, Graylog or OpenSearch; suitable plans are collected in VPS for Elasticsearch.
  2. Decide how long to keep them. Most incident reviews need 30–90 days of logs, because a break-in is often discovered well after the day it happened. A week or two on the server itself is enough; the rest belongs on the collection server or in an archive.
  3. Synchronise the clock. Without accurate time you cannot match events across servers. Run timedatectl: the "System clock synchronized" line should say yes.
  4. Do not log more than you need. Passwords, tokens and full card numbers must never end up in a log. Under the GDPR, IP addresses and user logins are personal data, so the retention period should be stated in your records of processing and your privacy policy; more in the article GDPR and choosing a host.
  5. In an incident, preserve first, then fix. Copy the logs and take a disk snapshot at the host before reinstalling the system. How snapshots and backups work is explained in the article VPS backups: strategies and tools.

If you need logs not only for investigations but also for alerts, such as a spike in 500 errors or a root login, they are collected together with metrics on a separate monitoring server. Plans for this are collected in VPS for monitoring.

FAQ

Where can I see who logged in to the server over SSH?

Run journalctl -u ssh (on AlmaLinux -u sshd) and filter for the word Accepted, or look in /var/log/auth.log, which is /var/log/secure on AlmaLinux. The last command shows a summary of logins; on Debian 13 use wtmpdb.

Why is there no /var/log/auth.log on Debian 12?

Debian 12 and later do not install rsyslog by default, so all messages, including logins, are kept only in journald. Read them with journalctl, or install rsyslog if you need text files.

How much space can logs take?

By default journald takes up to 10% of the file system, but no more than 4 GB. Web server and Docker logs without rotation are limited only by the size of the disk, so they need logrotate rules and the max-size and max-file settings.

Can I simply delete a large log file?

If a service keeps the file open, the space is freed only after the service restarts. It is safer to empty the file with truncate -s 0 and set up rotation so it does not happen again.

How long should logs be kept?

For incident review, 30–90 days is usually enough, with a week or two on the server itself. Under the GDPR, logs with IP addresses and logins contain personal data, so the retention period should be fixed in your records of processing and privacy policy.

Does fail2ban protect against break-ins?

It blocks addresses that repeatedly fail to log in and cuts the log down to meaningful events. It does not protect against distributed attacks or a login with a stolen key, so you still need key-only login and updates.

More in the guide

  • Hosting for a company website and domain mailA company website rarely gets heavy traffic, but it comes with staff mail on the domain, lead forms with personal data and an accounts department that needs invoices. Shared hosting covers all of this in one plan, provided you check the mail limits in advance, set up SPF, DKIM and DMARC and choose a host that works with companies. Below is what to look at and what it costs.
  • Hosting for a landing page or business card siteA landing page or a business card site does not need a powerful server or a VPS: the simplest shared hosting plan for a few dollars a month is enough. What matters more is that the plan includes free SSL, the domain stays yours and the page opens quickly on a phone. Below is how to choose a plan, what to check in it and what it costs.
  • How to choose hosting for an online shopA small shop on WooCommerce, OpenCart or 1C-Bitrix runs fine on a good shared hosting plan. Its requirements are stricter than those of a business card site, though: recent PHP and database versions, HTTPS on every page, headroom in the limits for sales and backups from which orders can be restored quickly. Below is what to check in a plan, what it costs and when it is time to move to a VPS.
  • A database on a VPS: PostgreSQL or MySQLA database is almost never limited by the processor; memory and disk are what hold it back. If the working set fits in the cache, queries are fast even on an inexpensive server; if it does not, disk speed decides everything. Here is how to choose between PostgreSQL and MySQL, how much memory to give the database, which disk to pick and how to avoid losing data.
  • File storage on a VPS: disks and object storageA project's files, such as user uploads, product photos, videos, documents and archives, grow faster than the database and the code. You can keep them on the server's disk, on a separate volume or in object storage, and the choice determines the price per terabyte, the speed and what happens to the files when you change servers. Here are the options and prices according to the accsly.io catalog.
  • How to leave a host without losing anythingPeople leave hosts for all sorts of reasons: prices went up, the server got slow, support stopped answering, or you need a different country. During a move you can lose data, emails, your domain and the money for months already paid. Here is an order of steps in which the old and new servers run side by side for a while, so that switching off the old one breaks nothing.
  • CI/CD on your own VPSA dedicated build server pays off when hosted CI minutes run out, builds are slow or jobs need access to internal resources. But a runner executes any code in the repository, so a mistake in its setup exposes the production server and every secret. Here is how GitLab and GitHub runners work, what resources they need, how to deploy over SSH and where to keep the keys.
  • VPS for developers: staging environmentsA staging environment exists so that you find the bug before your customers do. It should match the production server in software and configuration, but it can have half the resources and live for just a few days. Here is how to keep staging cheap, how to run several versions on one server and how to make sure a copy of the site does not end up in search results or send emails to real customers.
  • Linux distributions for a server: Ubuntu, Debian, AlmaLinuxFor a server, the choice is most often between three free distributions: Ubuntu, Debian and AlmaLinux. All three are stable and suitable for a website or a bot; they differ in how long they are supported, in their packages and in which panels and programs officially run on them. According to the accsly.io catalog as of November 2026, all three images are offered by 631 of the 1,241 hosts whose template list is known.
  • Load testing a website before launchA load test answers two questions: how many visitors a site can handle on the chosen server and what breaks first. It is run on your own server and only there: the load generator is a separate machine, the host has been notified and external services are replaced with stubs. Here are the numbers to watch, the tools that produce them and how to use them to choose a plan.
  • Updating a server without downtimeA server must not be left without updates, yet every update risks taking the site down. The risk is managed with a process: small security fixes are installed automatically, major changes follow a plan with a snapshot, testing and a ready rollback, and reboots are grouped into a maintenance window. Here is how to set this up on a single VPS.
  • CDN: when a website needs oneA CDN stores copies of a site's files on servers around the world and delivers them to each visitor from the nearest one. This speeds up loading of images, scripts and video and takes load off your server, but it does not make a slow CMS faster and does not replace choosing the right country for your server. Here is when a CDN is really needed and when a single VPS in the right place is enough.
  • Domains and DNS for a server ownerYou can switch servers in an evening, but a domain stays with a project for years. Through DNS, the domain points to your server, your mail and third-party services, and a single wrong record can take the site offline or send your emails to spam. Here are the records a VPS owner will need, how caching works, where to keep the zone and how to move to a new server without visitors noticing.
  • SSL certificates: free and paidA free certificate encrypts the connection just as reliably as a paid one: browsers make no distinction between them in terms of security. The difference lies in what the certificate authority checks, how long the certificate lasts and who is responsible for renewing it. According to the accsly.io catalog as of November 2026, free SSL is explicitly listed in 1,449 shared hosting plans from 178 hosts. Here is when that is enough and when a certificate is worth paying for.
  • 152-FZ and hosting: where to store the dataIf a website or service collects personal data of Russian citizens, that data must be recorded and stored in databases located in Russia: this is Part 5 of Article 18 of Federal Law No. 152-FZ. For choosing a VPS, this means the data centre's country matters, not the host's, and copies abroad fall under separate rules. Here is what the law requires, what duties fall on the server owner, how it applies to companies outside Russia and which setups are used in practice.
  • GDPR and choosing a hostThe EU General Data Protection Regulation (GDPR) does not require data to be kept in the EU, but it does require a data processing agreement with the host and a lawful mechanism for any transfer of data out of the EU. According to the accsly.io catalog as of November 2026, 61% of VPS hosts have servers in the EU, but almost half of them are registered outside the European Economic Area. Here is why that matters and what to check in the terms.
  • Hosting provider jurisdiction: what it affectsEvery server has two countries: the one where the data centre stands and the one where the company renting it out is registered. According to the accsly.io catalog as of November 2026, these are different countries for 15% of VPS hosts. The first determines latency and the rules on where data is stored; the second determines the law of the contract, the court for disputes, the documents your accountant receives and whose authorities can request your data. Here is what each of them changes.
  • How to compare VPS prices: the price of a resource unitA plan's price tells you how much you will pay, but not how much you get for that money. According to the accsly.io catalog as of November 2026, a gigabyte of memory on a 1 GB plan costs a median $8.00 a month, while on a 4 GB plan it costs $5.00. Here is how to work out the price per vCPU, per gigabyte of memory and of disk, and what to bring to a common basis before you compare two offers.
  • SLA and uptime: what hosts promiseAn SLA of 99.9% allows a host 43 minutes of downtime a month, 99.99% about four. But a percentage in an advert is not yet a commitment: the commitment is the document that says what counts as downtime, what is excluded and how much you get back. Most often that is a discount on the next invoice, not money. Here is how to read such documents and how to check availability yourself.
  • Free trials and money-back guaranteesThere are two ways to test a server before paying for a month or a year: a free trial or a money-back guarantee. According to the accsly.io catalog as of November 2026, 11% of VPS hosts offer a trial and 36% a money-back guarantee. But at many of them the terms apply only to shared hosting, only to the first order or only to card payments. Here is what to check so that the guarantee actually works.
  • Cloud server or VPSA cloud server and a VPS are usually the same KVM virtual machine. The difference lies in what surrounds it: a cloud sells resources by the hour through an API and offers network disks, snapshots and ready-made services, while a classic VPS is a fixed monthly plan with a local disk and a traffic allowance. Here is which of this you actually need and what it costs.
  • Dedicated server or VPSA VPS is a slice of a physical server, a dedicated server is the whole machine. With 4 cores and 8–16 GB of memory a VPS costs almost half as much, with 4 cores and 32 GB the prices are equal, and with 64 GB on 8 cores or 128 GB on 16 cores a dedicated server in the catalog is a third cheaper than a virtual one. Here is what else changes besides the price: neighbours, guarantees, delivery time, hardware failures and remote management.
  • Shared hosting or VPS for a websiteShared hosting is a ready place for a site where the host looks after the server. A VPS is your own server where you set everything up. For a landing page or an ordinary WordPress site, hosting is enough and costs several times less. You need a VPS when the account limits are too tight for the site or when it needs software that hosting does not allow. Below is what each option includes, what it costs and a table to help you choose.
  • DDoS protection: what hosting providers actually give youEvery second host now lists "DDoS protection" in its plans. Behind that line there may be multi-terabit filtering, or only the right to take your address offline when an attack bothers the neighbours. Here is what protection is made of, how L3/L4 differs from L7, and how to tell from the contract what you are buying.
  • Mail server on a VPS: SPF, DKIM, DMARCInstalling Postfix or a ready-made bundle like Mailcow on a VPS takes an hour. Getting your mail into the inbox rather than spam is harder: mailbox providers look at the port, the server's address, its reputation and three DNS records. Here is what to check with the host before buying and how to set up SPF, DKIM and DMARC.
  • Server monitoring: uptime, load, alertsWithout monitoring you learn that the server is down from your visitors, and that the disk is running out when the database stops writing. A few checks from outside and a dozen metrics from inside are enough to see a problem before users do. Here is what to measure, where to run checks and how to do it for free.
  • How to read hosting plans: the hidden limitsA plan card shows cores, memory, disk and a monthly price. Yet two plans with identical numbers can cost different amounts a year later and behave differently under load. The difference lies in terms printed in small type, in the acceptable use policy, or only in the contract. Below are eight places worth checking before you pay.
  • IPv4 and IPv6 on a serverA typical VPS has one public IPv4 address and, if the host supports it, an IPv6 subnet. An extra IPv4 address almost always costs money, and the cheapest plans sometimes come without their own IPv4 at all. Here is where the shortage comes from, what you can do with IPv6 alone and which address settings a mail server needs.
  • Bandwidth and traffic: what 1 Gbps and unlimited really meanA server plan usually has two network lines: port speed and traffic volume. The first says how fast the server can send data, the second how much it can send in a month. They are linked by simple arithmetic, and once you know it, it is easy to see what "1 Gbps unlimited" actually offers and whether "5 TB" will be enough for you.
  • Docker on a VPS: getting startedDocker lets you run a bot, a website, a database and monitoring on one server without them getting in each other's way, and moving to another VPS comes down to copying a couple of files and the data. Installation takes five minutes; the real trouble starts later: database ports exposed to the internet, logs growing to tens of gigabytes and data that vanished along with a container. Here is how to avoid all of that from the start.
  • How to move a website from shared hosting to a VPSThe move itself takes a couple of hours; the mistakes usually happen around it: a forgotten cron job, .htaccess rules that nginx does not read, an AAAA record with the old address, or mail that disappeared along with the IP change. Below is the order of steps with commands and checks for a PHP and MySQL site.
  • Server control panels: ISPmanager, FASTPANEL, aaPanelA panel turns a VPS into the kind of dashboard you know from shared hosting: sites, databases, mail and certificates are set up with a few clicks instead of editing config files. The three panels most often installed on Russian and budget international servers are ISPmanager, FASTPANEL and aaPanel. They differ in price, memory requirements and how much of the server they take over.
  • Windows VPS for 1CA rented server for 1C saves you from the office PC under a desk that nobody updates or backs up. But 1C on a VPS has its own quirks: the software licence is tied to the parameters of the virtual machine, users need both 1C and Windows licences, and core speed matters more than core count. Here is how to put together a 1C server for a small company.
  • Windows VPS: licensing, RDP and secure sign-inA Windows server costs more than Linux not only because of memory: the price includes a licence, and how it is arranged decides whether you are compliant and how many people can connect. An exposed RDP port is also the most common way such servers get hacked. Here are both topics.
  • When to move from shared hosting to a VPSA VPS does not make a site faster by itself: it gives you resources and freedom, and with them the job of running a server. Here is how to tell that hosting has become too small, when the problem can be solved without moving, and how to migrate a site so visitors notice nothing.
  • VPS backups: strategies and toolsOn a VPS, backups are your job, even if the plan says "backups included". We go through what exactly to back up, why a host snapshot is not enough, how to set up restic or BorgBackup in half an hour, and how to make sure you can actually restore from a backup.
  • First 10 steps after buying a VPS: securityBots start guessing passwords on a new server within minutes of it getting a public IP. Below are ten steps that close the most common holes in about an hour: commands for Ubuntu and Debian, the differences for AlmaLinux and Rocky Linux, and the checks that keep you from locking yourself out of your own server.
  • How to choose a country for your serverPut the server where your visitors are. For an audience across Europe, Germany, the Netherlands and Finland are convenient; for North America, the US East Coast. If you serve EU users, keeping the data in the EU makes GDPR simpler. Price hardly decides it: at the same host a server in Frankfurt, Amsterdam or New York usually costs the same, and only Asia and Australia are noticeably more expensive.
  • Hourly billing: when it pays offHourly billing pays off if you need the server for less than three weeks a month: for a test, a build, a one-off heavy job. At most hosts an hour costs exactly the monthly price divided by 730 hours, so over a full month you hardly overpay. The overpayment hides elsewhere: hourly plans are dearer on average, and for a server that runs all year, monthly billing or a year paid in advance usually comes out cheaper.
  • How much RAM and how many cores a website needsMost websites are fine with 2 GB of memory and one or two cores; a shop with thousands of products needs 4 GB and two cores. Memory matters more than cores: when it runs out, the site slows down or crashes, while an extra core without memory adds almost nothing. Below I show how to work out the memory for your site and how to see what it actually uses.
  • KVM or OpenVZ: which to chooseIn 2026 KVM is almost always the right pick: it costs a dollar or two more per month than OpenVZ, but everything runs on it, from Docker to Windows. OpenVZ makes sense in one narrow case, explained below, and at the end you will find the commands to check your own server in a minute.
  • NVMe or SSD: does it matter for a websiteFor a small site the difference between NVMe and SSD is barely noticeable, because pages are served from memory rather than from disk. It shows up in shops and sites with a large database. At the same host NVMe costs only about $0.50–1 a month more, and sometimes less, so what usually decides it is not the disk type but its size and how the host has limited it.
  • What is a VPS, in plain EnglishA VPS is a slice of a powerful physical server that you rent and that behaves like a separate computer, with its own operating system, its own IP address and full control. Below is how it differs from shared hosting, who needs one, what it costs and what to check right after you buy it.
  • VPS for a Telegram bot: what the bot needs and how to pick a planA bot with a menu and a few commands runs fine on the cheapest server, while a bot with broadcasts, files and a database hits completely different limits. Here is what a bot really consumes, which Telegram limits shape the choice of server and how to avoid overpaying.
  • How to test VPS ping and speed before you payThe numbers in a plan do not tell you the latency to your users or how fast the disk really is. Most of this can be measured before you pay, the rest in the first hour after launch. Here are the tools and how to read the results.
  • Corporate network on a VPS: remote access to the officeA rented server can become the hub of a company's private network: remote employees and branch offices connect through it to the ERP, file server, CRM and Git. Here are the common layouts, protocols, server requirements and security basics.
  • How to choose a VPS: the 7 specs that matterTwo plans with the same "2 cores, 4 GB, 50 GB" can differ several times in speed and twice in price a year later. Here is what stands behind each line of a VPS plan and what to check before you pay.
  • VPS vs VDS: is there a difference and what actually mattersIn most markets VPS and VDS mean the same thing: a virtual server. The difference that really affects your work is hidden not in the name but in the virtualization type and whether resources are guaranteed.