Redirecting ssh messages

[Matthew Gwin]

Does anyone know a way to make ssh redirect log messages (e.g. "Accepted publickey for user from x.x.x.x") to a seperate logfile instead of syslog.log? I'd love to cean up all that clutter...

[Steven E. Protter]

Shalom,

You should be able to configure that in the /etc/syslog.conf file

Then restart the syslog daemon.

SEP

[Kevin Wright · Accepted solution]

you could to something like:

in syslogd.conf
SyslogFacility AUTH
LogLevel INFO

Then restart sshd.

Then add this line to /etc/syslog.conf

auth.info;mail.none /var/adm/syslog/sshd.log

Or use a local facility.

[Matthew Gwin]

Kevin - I can't find a syslogd.conf file anywhere on my servers. I'm running 11.11. Is this a file I should create, and if so, where does it belong. Thanks!

[Matthew Gwin]

Thanks for setting me in the right direction Kevin - here's what I ended up doing:

(1) Enabled the following lines in /opt/ssh/etc/sshd_config:

SyslogFacility AUTH
LogLevel INFO

(2) Restarted sshd

(3) Added the following line to /etc/syslog.conf:

auth.info;mail.none /var/adm/syslog/sshd.log

(4) Changed this line in /etc/syslog.conf:
*.info;mail.none /var/adm/syslog/syslog.log

to:
*.info;auth.none;mail.none /var/adm/syslog/syslog.log

(5) kill -HUP `cat /var/run/syslog.pid`

[Matthew Gwin]

Solution described in comments above