I use ubuntu 10.04, contained ssh. I want to create a log file that stores all the activity on ssh (only ssh). Like in /var/log/auth.log
but only for ssh. Like /var/log/ssh.log
.
So, file ssh.log
will saving all records of the client when using ssh to a remote server.
Best Answer
I'm not sure if I get your question right, but in
/var/log/auth.log
are (beside other things) log entries coming fromsshd
. I think you want to create a logfile with only those entries fromsshd
to see who and when is accessing your server via ssh, right?sshd
uses syslog to do the logging, in your casersyslog
. This logging is configured in/etc/sshd/sshd_config
. The relevant settings areSyslogFacility
andLogLevel
. Look at the manpage to understand what they do.To get a single logfile
/var/log/sshd.log
which only contains messages coming fromsshd
you have to modify the rsyslog configuration. Create a file/etc/rsyslog.d/sshd.conf
and put the following line in it:Afterwards restart
rsyslog
with