# To see only successful login attempts with password: zgrep sshd /var/log/auth.log* -h |grep -F 'Accepted'