[SOLVED] Logging SSH in a separate file other than the regular /var/log/messages

satya123 · 04-13-2011, 05:49 AM

Hi,

Generally SSH related log messages are logged in /var/log/messages file. Is there a way to log them in another different file? I mean is there some configuration setting to enable this?

EricTRA · 04-13-2011, 06:01 AM

Hello,

From the manpage of sshd_config:

Quote:

SyslogFacility
Gives the facility code that is used when logging messages from sshd(8). The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. The
default is AUTH.

Then look at your syslog.conf / rsyslog.conf / ... to put in the rules to point to the logfile of your choice. Is that what you're looking for?

Kind regards,

Eric

satya123 · 04-13-2011, 06:17 AM

Actually, I am using syslog-ng for logging. And there is no default Audit message for SSH like AuditFTPDaemon.

chrism01 · 04-13-2011, 06:29 AM

Typical ssh log msg locations are in /var/log/messages, /var/log/secure, /var/log/audit/audit.log

satya123 · 04-13-2011, 06:54 AM

yeah..

but my question was is there a way to log SSH messages in another location other than the regular ones.

Or maybe i should rephrase my question and ask how to log SSH messages in a different location while using syslog-ng

EricTRA · 04-13-2011, 07:01 AM

Hello,

OK, that's a bit clearer. Have a look at this link. It's a bit outdated and for Suse but I guess you can get what you need from there.

Kind regards,

Eric

satya123 · 04-13-2011, 07:40 AM

Thanks a lot Eric.

That was the exact solution.

EricTRA · 04-13-2011, 07:43 AM

Hi,

Glad to be of assistance! Nice to hear you've got a solution. Have fun with Linux.

Kind regards,

Eric