I'm not sure if I get your question right, but in /var/log/auth.log
are (beside other things) log entries coming from sshd
. I think you want to create a logfile with only those entries from sshd
to see who and when is accessing your server via ssh, right?
sshd
uses syslog to do the logging, in your case rsyslog
. This logging is configured in /etc/sshd/sshd_config
. The relevant settings are SyslogFacility
and LogLevel
. Look at the manpage to understand what they do.
To get a single logfile /var/log/sshd.log
which only contains messages coming from sshd
you have to modify the rsyslog configuration. Create a file /etc/rsyslog.d/sshd.conf
and put the following line in it:
if $programname == 'sshd' then /var/log/sshd.log
Afterwards restart rsyslog
with
sudo service rsyslog restart