Right now, sshd is using the authpriv facility. The level of logging is fine, but I don't want it in the syslog, I want it to go to /var/log/sshd (which doesn't yet exist) on Red Hat Linux/Enterprise Linux. authpriv is configured to go to syslog by syslogd.conf. Do I need to change the facility on sshd to local2 (or any other unused local) for instance, and then direct local2 to /var/log/sshd or is there a better way?


Using ryslog you can set up a filter to redirect the log messages:

if $syslogfacility-text == 'authpriv' and $programname == 'sshd' then
    action(type="omfile" file="/var/log/sshd")
if $programname == 'sshd' then ~

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.