So im making a research honeypot. The host is ubuntu 14.04. I want to store all of the logs from the honeypot ssh to the ubuntu host so the data is not lost. Does anyone know anything about this?
I researched and google mostly said to modify the rsyslog.conf file but how do i do that? and on which machine? Do i make the alterations on the honeypot rsyslog or the host's rsyslog??
Thank you so much