Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use ubuntu 10.04, contained ssh. I want to create a log file that stores all the activity on ssh (only ssh). Like in /var/log/auth.log but only for ssh. Like /var/log/ssh.log.

So, file ssh.log will saving all records of the client when using ssh to a remote server.

share|improve this question
Which system logger are you running? rsyslog? – Andy Friese Dec 16 '12 at 16:58
@Andy: yes, rsyslog – dtnder Dec 17 '12 at 6:08

I'm not sure if I get your question right, but in /var/log/auth.log are (beside other things) log entries coming from sshd. I think you want to create a logfile with only those entries from sshd to see who and when is accessing your server via ssh, right?

sshd uses syslog to do the logging, in your case rsyslog. This logging is configured in /etc/sshd/sshd_config. The relevant settings are SyslogFacility and LogLevel. Look at the manpage to understand what they do.

To get a single logfile /var/log/sshd.log which only contains messages coming from sshd you have to modify the rsyslog configuration. Create a file /etc/rsyslog.d/sshd.conf and put the following line in it:

if $programname == 'sshd' then /var/log/sshd.log

Afterwards restart rsyslog with

sudo service rsyslog restart
share|improve this answer
Thank you. Now how to have more detail in sshd.log file? – shgnInc Jun 1 '14 at 10:34

To add more details to sshd.log, set the log level to verbose in /etc/ssh/sshd_config

Search for the LogLevel line and change it to

LogLevel Verbose

Then restart sshd

sudo service ssh restart 
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.