create log file just for ssh

Question

I use ubuntu 10.04, contained ssh. I want to create a log file that stores all the activity on ssh (only ssh). Like in /var/log/auth.log but only for ssh. Like /var/log/ssh.log.

So, file ssh.log will saving all records of the client when using ssh to a remote server.

Answer 1

I'm not sure if I get your question right, but in /var/log/auth.log are (beside other things) log entries coming from sshd. I think you want to create a logfile with only those entries from sshd to see who and when is accessing your server via ssh, right?

sshd uses syslog to do the logging, in your case rsyslog. This logging is configured in /etc/sshd/sshd_config. The relevant settings are SyslogFacility and LogLevel. Look at the manpage to understand what they do.

To get a single logfile /var/log/sshd.log which only contains messages coming from sshd you have to modify the rsyslog configuration. Create a file /etc/rsyslog.d/sshd.conf and put the following line in it:

if $programname == 'sshd' then /var/log/sshd.log

Afterwards restart rsyslog with

sudo service rsyslog restart