System Administration
cancel
Showing results for 
Search instead for 
Did you mean: 

Write a record in syslog when a user logs out

Fedon Kadifeli
Super Advisor

Write a record in syslog when a user logs out

We are using Secure Shell. Currently ssh logins are logged to syslog like this:

Aug 12 16:57:12 tsrsrv sshd[7787]: Accepted keyboard-interactive/pam for user1 from 10.x.y.z port 1029 ssh2

I want to have a similar record in syslog when a user logs out.

Not: In the future we are planning to send some syslog records to a separate machine (= a syslog server), so I currently need to record such events in syslog.
2 REPLIES
OldSchool
Honored Contributor

Re: Write a record in syslog when a user logs out

take a look at "logger". you can use that, along w/ "exit" traps in the profile to catch / log the logouts.
Fedon Kadifeli
Super Advisor

Re: Write a record in syslog when a user logs out

It turns out that the sshd_config directive

LogLevel VERBOSE

answers my question. Now we have the following in syslog:

Aug 13 10:00:36 tsrsrv sshd[23928]: Connection closed by 10.x.y.z
Aug 13 10:00:36 tsrsrv sshd[23928]: Closing connection to 10.x.y.z