By default in RHEL 6, SSH server logs are sent to
/var/log/secure. I want to change this location to a custom one. Is it possible to do that?
I have tried modifying the
rsyslog.conf file, but it does not work.
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
Choose an unused local facility. For example local3 is not used for any logging in your system. So first edit
/etc/sshd_config configuration file.
#SyslogFacility AUTH SyslogFacility local3
Now configure rsyslog to log local3 logs to a file that you need. Add the following to your
#Logging sshd to another file. Using local3 facility. local3.* /SOME/PATH/YOU/WANT/YOUR/SSHD/LOGS/TO-BE.log
/SOME/PATH/YOU/WANT/YOUR/SSHD/LOGS/TO-BE.log of course should be replaced by the location of the file where you want to redirect your sshd logs, sensibly I hope that could be
Then as usual, restart the service:
service rsyslogd restart
You can also specifically isolate sshd log to another file.
Append this line to
:programname, isequal, "sshd" /var/log/sshd.log
Note that sshd log will be written to both
/var/log/sshd.log, but this way we can isolate sshd to another file (no polkitd, no sudo, etc.)