I have fedora 23 as my desktop and I want make sure if any one has intruded in the past two weeks. Searching the web, I understood that for any possible ssh login, I have to check But this file does not exist.

Any suggestions to find out about possible sneaking with the help of the command line is very appreciated.

see if there's a /var/log/auth.log

No, there is not

Define "intruded"

I am kind of suspicious that someone has got remote access to my desktop

I found this:
https://ask.fedoraproject.org/en/que...ogs-on-fedora/

which says
On Fedora 20+, we use journalctl by default. Regular files such as /var/log/messages are no longer available by default.

You have a router?

I checked journalctl, but it is too long to find what I am looking for.
No, I don't have a router

Then you'll never find out.

What is "too long"?

Honestly, I'm not lazy...
I was hoping to be able to grep the date in journaltcl and check to see anything creepy, but seems that the date does not lead me to what I should look for.

What makes you believe someone intruded your system?

Mainly three reasons:
The weird mouse movement and occasional slow down
I use VPN a lot (I have to) and I met a hacker recently

If you haven't already done so, disable SSH access to your system

1 members found this post helpful.

I meet hackers all the time.
VPN too.

Try the journalctl utility again.

See https://access.redhat.com/documentat...e_Journal.html

1 members found this post helpful.

"Vague oddities," like "weird mouse movement" (especially ...), and "occasional slow-downs," are really not cause for suspicion that "someone, somewhere, somehow," has broken into your system and is right there, right now, creating mischief.

Sometimes, a substantial slowdown can be generated by something as innocuous as a file-content indexing daemon. The process runs infrequently but generates a lot of I/O activity when it does. Competition for the drive causes other processes to slow down.

You should, of course, know by what means your systems might be accessible to the outside world, what credentials are needed and so-forth. You should also always be keeping the software up-to-date. You should know that no services are running (nor listed in "xinetd") other than those which you know and intend to be running. And, so on.

1 members found this post helpful.

If you install the rsyslog package you'll get the traditional /var/log files in Fedora 23

2 members found this post helpful.