4

By default in RHEL 6, SSH server logs are sent to /var/log/secure. I want to change this location to a custom one. Is it possible to do that?

I have tried modifying the rsyslog.conf file, but it does not work.

  • How did you modify the file? And did you restart rsyslogd after making the change? – derobert Jul 19 '14 at 8:44
3

Choose an unused local facility. For example local3 is not used for any logging in your system. So first edit /etc/sshd_config configuration file.

 #SyslogFacility AUTH
 SyslogFacility local3

Now configure rsyslog to log local3 logs to a file that you need. Add the following to your /etc/rsyslog.conf .

#Logging sshd to another file. Using local3 facility.
local3.* /SOME/PATH/YOU/WANT/YOUR/SSHD/LOGS/TO-BE.log

Where /SOME/PATH/YOU/WANT/YOUR/SSHD/LOGS/TO-BE.log of course should be replaced by the location of the file where you want to redirect your sshd logs, sensibly I hope that could be /var/log/sshd.log .

Then as usual, restart the service:

   service rsyslogd restart 
0

You need to change/add the following line in your /etc/rsyslog.conf file:

authpriv.*                                              /var/log/custom_secure

and restart your rsyslog daemon (service rsyslogd restart).

  • authpriv is not privileged to ssh so this isnt a good solution – Christian Apr 12 '18 at 16:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.