how to filter sshd in syslog.log to other file

[Miguel Rodriguez_3]

I have a lot of messages like this in my /var/adm/syslog/syslog.log:

Nov 21 09:14:24 hostname sshd[13687]: Accepted password for oracle from 10.0.0.1 port 2831 ssh2
Nov 21 09:15:26 rubis sshd[14241]: Could not reverse map address 10.0.0.1.

How can I configure my /etc/syslog.conf in order to redirect these sshd messages to other file like /var/adm/syslog/sshd.log.

Right now I have configured ftpd and mail messages to other files.

[Steven E. Protter]

Threads that may help"
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=150919

This doc for sure:
http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B2355-90685/B2355-90685_top.html&con=/hpux/onlinedocs/B2355-90685/00/00/11-con.html&toc=/hpux/onlinedocs/B2355-90685/00/00/11-toc.html&searchterms=configuration%7csyslog.conf&queryid=20031121-074202

SEP

[Paula J Frazer-Campbell]

Hi

How about:-
Cat syslog.log | grep sshd > sshd.log


Pqaula

[Brian Bergstrand · Accepted solution]

Change sshd's syslog facility in /etc/opt/ssh/sshd_config.

Then edit /etc/syslog.conf to log that facility to a different file.

eg:

local1.debug /var/adm/syslog/sshd.log

Make sure you add 'local1.none' to other rules or you still get sshd entries in the system log files.

Restart sshd and syslogd.

HTH.

[Stefan Farrelly]

Change these lines in /etc/opt/ssh/sshd_config

SyslogFacility AUTH
LogLevel INFO

Then restart sshd.

Then add this line to /etc/syslog.conf

auth.info;mail.none /var/adm/syslog/sshd.log

Then restart syslogd and youre done!