I'm looking to log connections/disconnections from outgoing ssh sessions. Is this something auditd can do? I am able to get logs via auditbeat of the connections going outbound but the tricky part is tracking when the session is disconnected..
I have even tried using ss and parsing that every 1 second via filebeat, as ss has a field for connection status, but the status only ever shows established.
Example output of what I would be looking for would be:
TIMESTAMP 192.168.1.200:22 CONNECTED
TIMESTAMP 192.168.1.200:22 DISCONNECTED