Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I use ubuntu 10.04, contained ssh. I want to create a log file that stores all the activity on ssh (only ssh). Like in /var/log/auth.log but only for ssh. Like /var/log/ssh.log.

So, file ssh.log will saving all records of the client when using ssh to a remote server.

share|improve this question
1  
Which system logger are you running? rsyslog? –  Andy Friese Dec 16 '12 at 16:58
    
@Andy: yes, rsyslog –  dtnder Dec 17 '12 at 6:08
add comment

1 Answer 1

I'm not sure if I get your question right, but in /var/log/auth.log are (beside other things) log entries coming from sshd. I think you want to create a logfile with only those entries from sshd to see who and when is accessing your server via ssh, right?

sshd uses syslog to do the logging, in your case rsyslog. This logging is configured in /etc/sshd/sshd_config. The relevant settings are SyslogFacility and LogLevel. Look at the manpage to understand what they do.

To get a single logfile /var/log/sshd.log which only contains messages coming from sshd you have to modify the rsyslog configuration. Create a file /etc/rsyslog.d/sshd.conf and put the following line in it:

if $programname == 'sshd' then /var/log/sshd.log

Afterwards restart rsyslog with

sudo service rsyslog restart
share|improve this answer
    
Thank you. Now how to have more detail in sshd.log file? –  shgnInc Jun 1 at 10:34
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.