I have been trying to write a program to execute many commands during one ssh connection.
My current way is (1) create SSH connection; (2) create SSH command tunnel/channel whenever needed; (3) close SSH connection.
As expected, I see only two entries in /var/log/secure, corresponding to the ssh open & close event.
My problem is that there are many entries in /var/log/wtmp, corresponding to the log in & out event.
Could you help to comment on the relationships between these two file, in the context of recording SSH connections?
Any insight is appreciated! Sorry for the trouble if the terminology is not appropriate!