By default in RHEL 6, SSH server logs are sent to /var/log/secure. I want to change this location to a custom one. Is it possible to do that?

I have tried modifying the rsyslog.conf file, but it does not work.

  • How did you modify the file? And did you restart rsyslogd after making the change?
    – derobert
    Jul 19, 2014 at 8:44

3 Answers 3


Choose an unused local facility. For example local3 is not used for any logging in your system. So first edit /etc/sshd_config configuration file.

 #SyslogFacility AUTH
 SyslogFacility local3

Now configure rsyslog to log local3 logs to a file that you need. Add the following to your /etc/rsyslog.conf .

#Logging sshd to another file. Using local3 facility.

Where /SOME/PATH/YOU/WANT/YOUR/SSHD/LOGS/TO-BE.log of course should be replaced by the location of the file where you want to redirect your sshd logs, sensibly I hope that could be /var/log/sshd.log .

Then as usual, restart the service:

   service rsyslogd restart 

You need to change/add the following line in your /etc/rsyslog.conf file:

authpriv.*                                              /var/log/custom_secure

and restart your rsyslog daemon (service rsyslogd restart).

  • authpriv is not privileged to ssh so this isnt a good solution
    – Christian
    Apr 12, 2018 at 16:28

You can also specifically isolate sshd log to another file.

Append this line to /etc/rsyslog.conf:

:programname, isequal, "sshd" /var/log/sshd.log

Note that sshd log will be written to both /var/log/secure and /var/log/sshd.log, but this way we can isolate sshd to another file (no polkitd, no sudo, etc.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.