topic Redirecting ssh messages in Operating System - HP-UX

Redirecting ssh messages

Matthew Gwin — Tue, 26 Sep 2006 12:44:40 GMT

Does anyone know a way to make ssh redirect log messages (e.g. "Accepted publickey for user from x.x.x.x") to a seperate logfile instead of syslog.log? I'd love to cean up all that clutter...

Re: Redirecting ssh messages

Steven E. Protter — Tue, 26 Sep 2006 12:49:50 GMT

Shalom,

You should be able to configure that in the /etc/syslog.conf file

Then restart the syslog daemon.

SEP

Re: Redirecting ssh messages

Kevin Wright — Tue, 26 Sep 2006 12:54:36 GMT

you could to something like:

in syslogd.conf
SyslogFacility AUTH
LogLevel INFO

Then restart sshd.

Then add this line to /etc/syslog.conf

auth.info;mail.none /var/adm/syslog/sshd.log

Or use a local facility.

Re: Redirecting ssh messages

Matthew Gwin — Tue, 26 Sep 2006 15:22:30 GMT

Kevin - I can't find a syslogd.conf file anywhere on my servers. I'm running 11.11. Is this a file I should create, and if so, where does it belong. Thanks!

Re: Redirecting ssh messages

Matthew Gwin — Tue, 26 Sep 2006 15:54:40 GMT

Thanks for setting me in the right direction Kevin - here's what I ended up doing:

(1) Enabled the following lines in /opt/ssh/etc/sshd_config:

SyslogFacility AUTH
LogLevel INFO

(2) Restarted sshd

(3) Added the following line to /etc/syslog.conf:

auth.info;mail.none /var/adm/syslog/sshd.log

(4) Changed this line in /etc/syslog.conf:
*.info;mail.none /var/adm/syslog/syslog.log

to:
*.info;auth.none;mail.none /var/adm/syslog/syslog.log

(5) kill -HUP `cat /var/run/syslog.pid`

Re: Redirecting ssh messages

Matthew Gwin — Tue, 26 Sep 2006 15:56:11 GMT

Solution described in comments above