ssh log in syslog

[Khashru]

When ever someone logs in to the system using ssh there is an entry in the syslog. I want to disable this for a particular user.

I want sshd to log every one except that user in syslog. Can it be done.

[rariasn]

Hi:

http://h30499.www3.hp.com/t5/System-Administration/how-to-filter-sshd-in-syslog-log-to-other-file/m-p/3125831#M151983

rgs,

[Mel Burslan]

As the thread referenced in the first response explains, you can change the log file of the sshd to something other than syslog.log but this change is global to all ssh users not only to a single one.

What you are doing is quite suspicious and will raise eyebrows when you go through an audit and your scheme gets found out. As if you are trying to hide the actions of some user, by hiding his/her logins to the system. Very bad idea in my opinion, despite how good your intentions might be (don't know how can there be any good intentions for such a setup though but giving it the benefit of the doubt here)

[Khashru]

We use nagis monitoring to monitor the system and it uses ssh login. It logs in to the system tousands times a day. I donot want unnecessary information in the syslog. This will reduce the size of syslog and i will be able to find the important information from syslog.

[Ralph Grothe]

So the entries come from check_by_ssh Nagios checks I suppose.
Running local checks via nrpe wouldn't be an option?
Or you could reverse from Nagios actively polling the host a thousand times a day to sending only non-ok check results a few times a month via nsca to the nagios server.
Maybe you could also SyslogFacility in your sshd's sshd_config to some localX facility and configure the host's syslogd to pipe it into a filter which would strip off check_by_ssh connects from the nagios server?