See man sshd_config:
Code:
SyslogFacility
Gives the facility code that is used when logging messages from
sshd. The possible values are: DAEMON, USER, AUTH, LOCAL0,
LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. The
default is AUTH.
And /etc/syslog.conf specifies where messages for each facility should be logged. (A common choice for AUTH, if you stay with that default, is /var/log/auth.log .)
/Quigi