This article describes how the SSH login events look in the file messages

System log messages are generated whenever a user successfully or unsuccessfully attempts SSH access. Logout events are also recorded.

For example, the following logs are the result of two failed authentication attempts, then a successful one, and finally a logout:

<timestamp> sshd[16645]: Failed password for op from 172.17.58.45 port 1673 ssh2

<timestamp>  sshd[16645]: Failed password for op from 172.17.58.45 port 1673 ssh2

<timestamp> sshd[16645]: Accepted password for op from 172.17.58.45 port 1673 ssh2 

<timestamp>  mgd[16648]: UI_AUTH_EVENT: Authenticated user 'op' at permission level 'j-operator'

<timestamp> mgd[16648]: UI_LOGIN_EVENT: User 'op' login, class 'j-operator' [16648]

<timestamp>  mgd[16648]: UI_CMDLINE_READ_LINE: User 'op', command 'quit '

<timestamp>  mgd[16648]: UI_LOGOUT_EVENT: User 'op' logout