When I log into a remote
centos 7 server as root, I am able to see the
sshd logs by typing
journalctl _COMM=sshd in the terminal. But the logs are massive. How can I download all the logs into a format such as a text file for analysis on my local machine?
Redirect them out to a file:
journalctl _COMM=sshd > sshd_logs
Skip the creation of a file on the remote server, and stream the logs directly to your local machine:
ssh -nC firstname.lastname@example.org journalctl _COMM=sshd > remote-sshd_logs
As a general hint, it's a good idea to run remote root commands on the ssh command line (as in the above example), and save them in your command history.
That way, you can recall the command and rerun it with much lower risk of a typo than if you were to log in as root and type the same command at the root prompt from memory. As a bonus, this means the command will be logged in the
sshd log, which helps you (or fellow sysadmins) figure out timelines if something goes wrong.