Right now, sshd is using the authpriv facility. The level of logging is fine, but I don't want it in the syslog, I want it to go to /var/log/sshd (which doesn't yet exist) on Red Hat Linux/Enterprise Linux. authpriv is configured to go to syslog by syslogd.conf. Do I need to change the facility on sshd to local2 (or any other unused local) for instance, and then direct local2 to /var/log/sshd or is there a better way?

1 Answer 1


Using ryslog you can set up a filter to redirect the log messages:

if $syslogfacility-text == 'authpriv' and $programname == 'sshd' then
    action(type="omfile" file="/var/log/sshd")
if $programname == 'sshd' then ~

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .