When I log into a remote centos 7 server as root, I am able to see the sshd logs by typing journalctl _COMM=sshd in the terminal. But the logs are massive. How can I download all the logs into a format such as a text file for analysis on my local machine?


Redirect them out to a file:

journalctl _COMM=sshd > sshd_logs

Skip the creation of a file on the remote server, and stream the logs directly to your local machine:

ssh -nC root@remote.server.hostname journalctl _COMM=sshd > remote-sshd_logs

As a general hint, it's a good idea to run remote root commands on the ssh command line (as in the above example), and save them in your command history. That way, you can recall the command and rerun it with much lower risk of a typo than if you were to log in as root and type the same command at the root prompt from memory. As a bonus, this means the command will be logged in the sshd log, which helps you (or fellow sysadmins) figure out timelines if something goes wrong.

  • Thank you and +1 for taking the time to answer. In addition to the question I linked to in my comment to Patrick's answer, I also have a question about how to get firewalld logs. Are you willing to help me with it also? Here is the link: unix.stackexchange.com/questions/171335/…
    – CodeMed
    Dec 5 '14 at 0:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.