So stupidly enough in our development team every individual SSH Key is used to access the root user directly.
When Checking the auth.log I can find this
Dec 18 09:45:04 webserver sshd: Accepted publickey for root from xx.xx.xx.xx port xx ssh2 Dec 18 09:45:04 webserver sshd: pam_unix(sshd:session): session opened for user root by (uid=0)
Is there any way to see which publickey was used? Maybe change something for the log levels? Or do I need to look in another place?