Authentication logs help explain login attempts, privilege changes, and session activity. They are security-sensitive evidence, but one line rarely establishes a user's intent or proves that an account was compromised.
Logging · Lesson 5
Authentication Logging
Learn how to locate, interpret, and safely correlate Linux authentication records.