downloading sshd logs from remote centos 7 server

Question

When I log into a remote centos 7 server as root, I am able to see the sshd logs by typing journalctl _COMM=sshd in the terminal. But the logs are massive. How can I download all the logs into a format such as a text file for analysis on my local machine?

Answer 1

Redirect them out to a file:

journalctl _COMM=sshd > sshd_logs

Answer 2

Skip the creation of a file on the remote server, and stream the logs directly to your local machine:

ssh -nC [email protected] journalctl _COMM=sshd > remote-sshd_logs

As a general hint, it's a good idea to run remote root commands on the ssh command line (as in the above example), and save them in your command history. That way, you can recall the command and rerun it with much lower risk of a typo than if you were to log in as root and type the same command at the root prompt from memory. As a bonus, this means the command will be logged in the sshd log, which helps you (or fellow sysadmins) figure out timelines if something goes wrong.