By default in RHEL 6, SSH server logs are sent to
/var/log/secure. I want to change this location to a custom one. Is it possible to do that?
I have tried modifying the
rsyslog.conf file, but it does not work.
Choose an unused local facility. For example local3 is not used for any logging in your system. So first edit
/etc/sshd_config configuration file.
#SyslogFacility AUTH SyslogFacility local3
Now configure rsyslog to log local3 logs to a file that you need. Add the following to your
#Logging sshd to another file. Using local3 facility. local3.* /SOME/PATH/YOU/WANT/YOUR/SSHD/LOGS/TO-BE.log
/SOME/PATH/YOU/WANT/YOUR/SSHD/LOGS/TO-BE.log of course should be replaced by the location of the file where you want to redirect your sshd logs, sensibly I hope that could be
Then as usual, restart the service:
service rsyslogd restart