topic ssh log in syslog in Operating System - HP-UX

ssh log in syslog

Khashru — Tue, 24 May 2011 04:53:36 GMT

When ever someone logs in to the system using ssh there is an entry in the syslog. I want to disable this for a particular user.

I want sshd to log every one except that user in syslog. Can it be done.

Re: ssh log in syslog

rariasn — Thu, 07 Jul 2011 15:51:07 GMT

Hi:

http://h30499.www3.hp.com/t5/System-Administration/how-to-filter-sshd-in-syslog-log-to-other-file/m-p/3125831#M151983

rgs,

Re: ssh log in syslog

Mel Burslan — Tue, 24 May 2011 13:58:26 GMT

As the thread referenced in the first response explains, you can change the log file of the sshd to something other than syslog.log but this change is global to all ssh users not only to a single one.

What you are doing is quite suspicious and will raise eyebrows when you go through an audit and your scheme gets found out. As if you are trying to hide the actions of some user, by hiding his/her logins to the system. Very bad idea in my opinion, despite how good your intentions might be (don't know how can there be any good intentions for such a setup though but giving it the benefit of the doubt here)

Re: ssh log in syslog

Khashru — Tue, 24 May 2011 22:35:59 GMT

We use nagis monitoring to monitor the system and it uses ssh login. It logs in to the system tousands times a day. I donot want unnecessary information in the syslog. This will reduce the size of syslog and i will be able to find the important information from syslog.

Re: ssh log in syslog

Ralph Grothe — Wed, 25 May 2011 12:18:49 GMT

So the entries come from check_by_ssh Nagios checks I suppose.
Running local checks via nrpe wouldn't be an option?
Or you could reverse from Nagios actively polling the host a thousand times a day to sending only non-ok check results a few times a month via nsca to the nagios server.
Maybe you could also SyslogFacility in your sshd's sshd_config to some localX facility and configure the host's syslogd to pipe it into a filter which would strip off check_by_ssh connects from the nagios server?