SSH / auth.log Parser

Paste auth.log or /var/log/secure lines, one per line, including the syslog header. A message is classified only when the syslog tag and the message form a known pair. The sshd events — Accepted, Failed, Invalid user, Connection closed, Disconnected — are read only under the sshd or sshd-session tag, the sudo TTY/USER/COMMAND line only under sudo, and a PAM line (session opened, session closed, authentication failure) only when the service inside pam_unix(service:type) is the program that logged it, or a known alias of it such as OpenSSH 9.8's sshd-session writing pam_unix(sshd:…). An unrelated daemon that happens to log the same sentence stays listed as other, because the message text alone is not evidence of an SSH login. Recognized lines expose the account, authentication method, source host and port, key fingerprint, and the sudo command as logged. A line that matches none of those shapes stays listed as other with its text unchanged rather than being force-fitted. The counts are counts: accepted logins per account, and failed or invalid-user events per source host. The tool does not decide that a source is an attacker, does not score severity, and does not conclude that a run of failures is a brute-force attempt. The syslog timestamp carries no year and no time zone, so no absolute time is shown. Input is capped at 400,000 characters and 2,000 lines. Everything runs locally; nothing is uploaded, stored, or written into the URL.