cat /var/log/secure and grep patter on CentOS Linux
1. change to root $ su - 2. grep pattern to authntication failure login user root $ cat /var/log/secure | grep -E 'authenctication failure.*rhost=.*user=root' # AND syntax 3. grep pattern for OR syntax $ cat /var/log/secure | grep -E 'authentication failure|user=root'