What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Start with the computer’s authentication records, then corroborate what they show with session history, reboot records, the system journal, and any audit data that was already enabled. On Ubuntu, remote logins are commonly recorded in /var/log/auth.log; other distributions may use different files or rely on the systemd journal. A successful login that matches an unapproved account, time, or source address is a reason to investigate. A failed password attempt or one unfamiliar address is not, by itself, proof that someone got in.
The goal of a first-pass check is a defensible timeline: which account was involved, when authentication occurred, where it came from, whether it succeeded, and what the system recorded afterward. Logs can be missing, rotated, truncated, volatile, or never enabled, so an empty search cannot prove that remote access did not happen.
What counts as evidence of unauthorized remote access?
Linux records several different kinds of events, and each answers a different question. Authentication records show attempts to prove an identity. Session records show logins that the system recognized. The journal can add service and system context. Reboot records explain gaps or changes in the timeline. Audit records can be more detailed, but only when auditd and the relevant rules were active before the event.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallUse these records together rather than treating one line as a verdict. For each event, record:
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
- the account name;
- the exact timestamp and time zone, if shown;
- the source address or hostname, when available;
- whether authentication succeeded or failed;
- the session or process that followed; and
- any reboot, shutdown, or logging gap around the same time.
An address identifies a network endpoint, not necessarily a person. It may belong to a home router, corporate gateway, VPN, cloud host, or shared administrator. Compare it with the account owner’s expected networks and access schedule before drawing a conclusion.
Step 1: Identify where this computer keeps its records
Check the distribution and logging choices
Do not assume that every Linux installation has the same file layout. Ubuntu’s documentation identifies /var/log/auth.log as an authorization log that includes remote login events. Other distributions may route equivalent messages to a different file, send them to the systemd journal, or apply local retention rules. A minimal installation, hardened image, container, or custom logging configuration can also change what is present.
First note the distribution, release, SSH service, and whether the machine uses systemd. Then look for the authorization log named by that distribution’s documentation and for journal entries covering the suspected period. Keep the investigation read-only where practical: opening and querying records is different from deleting, rotating, or rewriting them.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsUnderstand journal retention before trusting a time range
journalctl can query retained systemd journal records. Red Hat’s reboot-investigation guidance notes that reviewing previous boots this way depends on persistent journal storage. If the journal was only kept in volatile storage, older entries may disappear at shutdown. Retention limits, rotation, disk cleanup, and a machine that was offline can produce the same apparent gap.
For a known window, query the journal by time rather than scrolling through everything:
journalctl --since "2026-10-16 00:00" --until "2026-10-17 00:00"Replace the dates with the period you are investigating and use the host’s local time zone. Narrow the output to SSH-related messages using the service or message filters supported by that installation. If an older period returns nothing, record that the data was not retained; do not convert the absence into “no one logged in.”
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Step 2: Review SSH authentication attempts
Search the authorization log or journal
Search the authorization source for the SSH daemon’s entries. On an Ubuntu system using the documented default, that source is usually /var/log/auth.log. Read enough surrounding lines to distinguish an authentication attempt from a later session message and to capture the account, result, time, and address.
Separate successful and failed events. A failed password, rejected key, or blocked attempt establishes that the system saw an unsuccessful attempt. It does not establish that the attacker obtained access. A successful authentication is more significant, but it still needs account and context checks: the account could belong to an administrator, an automation job, or a user connecting through an expected VPN.
Check the fields that matter
- Account: Was this user authorized to connect? Check whether the account was active and expected at that time.
- Time: Does the timestamp fall within a maintenance window, on-call shift, scheduled job, or the user’s normal working hours?
- Source: Is the address consistent with the user’s normal network, VPN, jump host, or administrator? Treat unfamiliar addresses as leads, not proof of malice.
- Result: Was authentication accepted or rejected? Do not group failed attempts with successful sessions.
- Follow-on activity: Is there a matching session, command, service change, or reboot after a successful login?
Keep the original line or a precise transcription in your notes, including its time zone and any address field. Copying only the username can make later correlation difficult.
Use the journal when the file is absent
If the expected authorization file is missing, query the journal for SSH daemon and authentication messages. The exact unit name and message fields depend on the distribution and service configuration. A missing file can mean that logs were routed elsewhere, disabled, rotated, or never retained; it does not establish that SSH was unused.
Step 3: Corroborate with session and reboot history
Inspect login records
Ubuntu describes /var/log/wtmp as a source of login records used by utilities such as who. Use the available session-history tool as a second record, not as a replacement for authentication logs. Compare each session’s user and time with the SSH event that appears to have created it.
When a session record and an authentication record disagree, investigate the difference. They may represent different stages of the same connection, different time zones, a local console login, or incomplete logging. Do not silently choose the record that supports a preferred conclusion.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Check shutdowns and reboots
Red Hat documents last -x for reviewing shutdown and reboot records:
last -xPlace reboot and shutdown times beside authentication and session events. A reboot can explain why a service restarted, why volatile journal entries disappeared, or why a session ended. It can also mark a boundary between two sets of records. A gap around a crash is not automatically suspicious, but it must be included in the timeline.
Account for incomplete wtmp data
Login history is affected by retention, rotation, truncation, and the health of the storage holding the file. Red Hat’s example discusses cases in which wtmp may have been truncated before a crash. Therefore, a short or empty history is not a guarantee that every login is absent. Record what the file contains and how far back it appears to go.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Step 4: Use auditd records when they were already enabled
What auditd can add
On a system with auditd configured before the suspected access, ausearch can filter authentication events by message type, time, and success status. Red Hat demonstrates searches for USER_LOGIN events and shows records that can include an SSH address and a result field. Those fields can make it easier to connect an accepted or rejected login to the source endpoint and outcome.
One practical pattern is to run separate searches for successful and unsuccessful results, adapting the time syntax to the audit version installed on the host:
ausearch -m USER_LOGIN -ts recent -sv yes
ausearch -m USER_LOGIN -ts recent -sv noUse a bounded start and end time when your local ausearch supports them, and verify the option names in the installed manual. The important distinction is not the spelling of a switch; it is that you examine USER_LOGIN events for the relevant period and separate success from failure.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Know what the audit rules covered
Debian’s example rules cover SSH authentication logs and daemon configuration, login and session files, account files, and command execution. Such rules illustrate the kinds of changes an administrator can record, but they are not a claim that every Linux computer collected those events. Rules may have been absent, unloaded, scoped differently, or enabled only after the suspected incident.
Do not enable a new rule now and present the resulting data as evidence of an earlier event. New rules improve collection from the moment they load onward. They cannot recreate records that were never captured. Treat community-maintained examples as configuration guidance to adapt for the host, not as a universal forensic policy.
Build a single, evidence-based timeline
A timeline prevents one alarming line from dominating the investigation. Put every relevant event in chronological order and keep the source of each entry visible.
| Time | Source | Account or event | Address | Result | What to check next |
|---|---|---|---|---|---|
| Timestamp with time zone | Authorization log, journal, wtmp, last -x, or auditd | User, SSH event, session, reboot, or shutdown | Address if recorded; otherwise “not shown” | Success, failure, or system event | Expected user, matching session, and follow-on activity |
Start with the earliest suspicious authentication attempt and extend the window far enough to include the resulting session, commands, service changes, shutdown, or reboot. For each successful login, ask:
- Was the account permitted to use remote access?
- Was the time expected for that account or an approved maintenance task?
- Was the source address consistent with the user’s network, VPN, or administration path?
- Does a session record corroborate the authentication?
- Do journal or audit records show activity afterward?
- Is there a reboot, crash, rotation, or retention gap that limits what can be seen?
Evidence becomes more concerning when independent records agree: for example, an accepted SSH authentication for an unapproved account, a matching session, and subsequent activity under that account. Even then, preserve the distinction between “strong reason to investigate” and a definitive attribution of who connected.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →How to interpret common findings
Many failed attempts, no successful login
This pattern shows unsuccessful attempts recorded by the system. It may reflect internet scanning, a misconfigured user, a forgotten key, or a real attack that did not gain entry. Check whether any later authentication succeeded and whether the source addresses match expected administrators. Do not describe the failed attempts alone as a compromise.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
One unfamiliar source address with a successful login
Verify the account owner, VPN use, corporate egress addresses, jump hosts, and cloud administration paths. Shared gateways can make several people appear to use one address, while a personal VPN can make a legitimate user appear unfamiliar. If no authorized explanation exists and the session or follow-on records match, treat it as a serious incident requiring qualified response.
A successful login with no session record
Do not assume that the authentication line is false or that the connection was harmless. Session records may be incomplete, rotated, or written differently by the service. Compare the journal, wtmp history, audit events, and reboot timeline, and document which sources were unavailable.
No matching entries anywhere
An empty search can mean the wrong log source was checked, retention expired, journaling was volatile, audit rules were absent, the machine was restored, or records were altered. It can support only the narrower statement that the searched records contain no matching event. It cannot prove that the computer was never accessed.
Recommended Free Tools
Unexpected reboot near the suspected time
A reboot may be routine maintenance, a crash, or part of an attacker’s activity. Use last -x, retained journal entries, and the authorization timeline to determine what happened before and after it. If the reboot created a logging gap, state that limitation explicitly.
Compare the available evidence sources
| Source | Primary use | Typical detail | Collection limitation |
|---|---|---|---|
Authorization log such as Ubuntu’s /var/log/auth.log |
SSH and other authorization events | Account, time, authentication outcome, and sometimes address | Path, format, and retention vary by distribution and configuration |
systemd journal queried with journalctl |
Service and system context, including SSH messages where logged | Timestamped service and system records; may span boots | Older boots require persistent journal storage; rotation and volatile storage remove history |
/var/log/wtmp and tools such as who |
Login and session history | Recognized sessions and times | Can be rotated, truncated, incomplete, or affected by a crash |
last -x |
Shutdown and reboot context in addition to login history | Boot, shutdown, and related records | Depends on retained history and the integrity of the underlying records |
auditd queried with ausearch |
Configured authentication, file, account, and command events | Potentially detailed event type, result, address, and object | Only events covered by rules that were active before the event are available |
The most useful source is not always the most detailed one. A detailed audit record is irrelevant to a period before auditd was enabled, while a modest authorization entry may be decisive when it aligns with a session and an approved access schedule.
Preserve the limits of a first-pass check
This procedure identifies records that deserve attention; it is not a complete incident-response or forensic-acquisition protocol. Logs may be disabled, rotated, volatile, incomplete, truncated, or altered. The cited Linux guidance explains where records are commonly found and how to query them, but it does not establish a distribution-neutral test that proves a machine was or was not accessed.
If you find a successful login that was not authorized, avoid improvising a large cleanup that could destroy evidence. Record the times, accounts, addresses, and matching events you found, and seek qualified incident-response assistance for containment and evidence preservation. The appropriate next steps depend on the system’s role, data sensitivity, network exposure, and whether other machines may be involved.
Free tools Windows power users keep installed
One-click scans. No signup required.
A practical decision rule
Classify the result using the narrowest statement supported by the records:
- Attempt observed: the system recorded a failed authentication or other rejected request.
- Access indicated: a successful authentication and a corroborating session or system record exist, but authorization is still being checked.
- Likely unauthorized access: a successful event for an account or time that no responsible administrator can explain, especially when subsequent activity matches.
- Undetermined: records are absent, conflicting, or too incomplete to establish what happened.
This wording keeps the conclusion tied to evidence. It avoids both false reassurance from empty logs and false certainty from a single unfamiliar address.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
