LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Server (https://www.linuxquestions.org/questions/linux-server-73/)
-   -   how to log ssh activity in /var/log/ssh/ssh*.log (https://www.linuxquestions.org/questions/linux-server-73/how-to-log-ssh-activity-in-var-log-ssh-ssh%2A-log-911138/)

MrUmunhum 10-31-2011 04:33 PM
how to log ssh activity in /var/log/ssh/ssh*.log
 
Hi group,

I need to log ssh access in /var/log/ssh/*.log. I know I need to modify /etc/ssh/sshd_config but have not been able to find the magic syntax.

Amy pointers?

Thanks for your time.

unSpawn 10-31-2011 05:13 PM
Quote:
Originally Posted by MrUmunhum (Post 4512801)
I need to log ssh access in /var/log/ssh/*.log. I know I need to modify /etc/ssh/sshd_config but have not been able to find the magic syntax.
Dunno what the asterisk stands for but try 'man sshd_config': SyslogFacility (chose one of LOCAL), 'man syslog.conf': EXAMPLES (as in say "local0.* /var/log/ssh.log").

MrUmunhum 11-01-2011 11:56 AM
Quote:
Originally Posted by unSpawn (Post 4512821)
Dunno what the asterisk stands for but try 'man sshd_config': SyslogFacility (chose one of LOCAL), 'man syslog.conf': EXAMPLES (as in say "local0.* /var/log/ssh.log").
Tried this:
# Logging
# obsoletes QuietMode and FascistLogging
SyslogFacility LOCAL0
#SyslogFacility AUTHPRIV
LogLevel INFO

local0.* /var/log/ssh.log
. . .

And got this:
service sshd restart
Stopping sshd: [ OK ]
Starting sshd: /etc/ssh/sshd_config: line 37: Bad configuration option: local0.*
/etc/ssh/sshd_config: terminating, 1 bad configuration options
[FAILED]

Could not find example in man sshd_config.

unSpawn 11-02-2011 02:25 AM
Quote:
Originally Posted by MrUmunhum (Post 4513353)
Starting sshd: /etc/ssh/sshd_config: line 37: Bad configuration option: local0.*
(..)
Could not find example in man sshd_config.
I gave you two manual pages to read. The "local0.* /var/log/ssh.log" line is in /etc/syslog.conf.


All times are GMT -5. The time now is 04:34 PM.