1、修改SSH程序

[[email protected] ~]# vim /etc/ssh/sshd_config

將SyslogFacility AUTHPRIV改為SyslogFacility local5

2、修改日誌程序

[[email protected] ~]#Vim /etc/syslog.conf

添加如下兩行：

＃ save sshd messages also to sshd.log

local5.* /data/log/sshd.log

3、重啟sshd和syslog服務

然後你可以使用ssh來登錄看看發現與sshd有關的信息都記錄到了sshd.log中。不在是messages。

4、從server02嘗試登陸server01

[[email protected] ~]# ssh server01

[email protected]‘s password:

Last login: Mon Aug 28 01:53:43 2017 from server02

[[email protected] ~]# exit

logout

Connection to server01 closed.

[[email protected] ~]#

5、查看登陸日誌

[[email protected] ~]# tail -f /data/log/sshd.log

Aug 28 01:56:30 server01 sshd[52123]: Accepted password for root from 192.168.112.141 port 54508 ssh2

Aug 28 01:56:45 server01 sshd[52123]: Received disconnect from 192.168.112.141: 11: disconnected by user

本文出自 “平平淡淡才是真” 博客，請務必保留此出處http://ucode.blog.51cto.com/10837891/1959897

修改SSHD服務日誌記錄