How to View Failed Login Attempts Using the lastb Command in Linux

When you are managing the security architecture of a public-facing Linux server, relying solely on standard firewall metrics to identify attacks is a catastrophic vulnerability. Malicious bots execute thousands of automated SSH login attempts every hour, trying to brute-force your passwords. If you do not actively monitor these failed attempts, you are mathematically blind to ongoing siege operations. To force the Linux kernel to dump a highly structured matrix of every single failed login attempt, you must use the lastb command.

Executing the Forensic Security Audit

The lastb command is a deeply integrated forensic extraction engine. It bypasses standard text logs and directly parses the highly compressed, binary /var/log/btmp file, which is specifically engineered by the kernel to record exclusively bad (failed) authentication events.

CRITICAL SECURITY WARNING: Because the btmp file contains highly sensitive security telemetry (including the exact usernames the hackers are attempting to exploit), the lastb engine is mathematically locked. You cannot run it as a standard user. You must deploy absolute root privileges.

To execute the extraction, open your terminal and type:

sudo lastb

The exact millisecond you authenticate, the engine violently rips the binary file open, translates the data, and floods your terminal with a massive matrix containing:

• Target Username: The exact string the attacker attempted to use (e.g., root, admin, or absolute gibberish).
• Terminal: The port or connection type (usually ssh:notty).
• Attacker IP Address: The absolute physical IP coordinate the attack originated from.
• Chronological Timestamp: The exact date and time the failed attempt occurred.

Automating Threat Isolation

If a botnet is hammering your server, the lastb output will be thousands of lines long, making it mathematically impossible to read. You must pipe the output into secondary extraction engines.

sudo lastb | awk '{print $3}' | sort | uniq -c | sort -nr | head -10

This highly advanced architectural command sequence extracts only the attacker IP addresses (Column 3), mathematically sorts them, counts the exact number of failed attempts per IP, violently orders the list from highest to lowest, and outputs the absolute top 10 most aggressive attackers. You can instantly take these 10 IP addresses and permanently block them at the firewall level.