Generate synthetic sshd / OpenSSH auth logs

This sample, generated

The block below is 15 lines of sshd / OpenSSH auth logs, produced by the real generator at seed 42 — deterministic, so this exact output regenerates anywhere. The live tool re-runs the identical engine on whatever source, seed, line count and anomalies you pick.

Generated sshd / OpenSSH auth logs

Real on-the-wire sshd / OpenSSH auth logs — no real users, IPs, or secrets. Copy it into a fixture, feed it to a parser, or seed a SIEM demo.

With an anomaly injected: SSH brute-force

The same source, regenerated with a SSH brute-force injected at 30% intensity. 6 line sare tagged and highlighted below — A burst of failed logins from one source IP, then a success — the classic credential-stuffing signature. It is a documented, detectable pattern your SIEM rules should fire on — build the test data, then prove your detection works.

FAQ

Are these real sshd logs?

No — every line is synthetic. The output matches the OpenSSH syslog auth format exactly, but the usernames, hosts and IPs are fabricated. No real login attempts are involved, so it is safe for detection labs, fixtures and demos.

Can I inject an SSH brute-force?

Yes — that is the headline pattern for this source. The SSH brute-force slider appends a burst of "Failed password" lines for one user from one attacker IP, then a single "Accepted password" (the breach). Those lines are highlighted and badged so you can confirm your brute-force rule catches them.

Is the output deterministic?

Yes. Generation is fully seeded, so the same seed and config always yield byte-identical sshd lines — commit a seed to a fixture and regenerate the exact same log on any machine or in CI.

Generate other log sources

• nginx access logs
• Apache access logs
• RFC 3164 (BSD) syslog
• RFC 5424 syslog
• FortiGate firewall logs
• Cisco ASA firewall logs
• Windows Security Event logs
• JSON application logs
• Docker container logs
• Kubernetes (klog) logs
• AWS VPC Flow logs

Open the LogAnvil generator to tune the seed, line count, EPS, format and anomaly sliders — or build a parser with LogForge for a log you already have.