修改SSHD服務日誌記錄
1、修改SSH程序
[[email protected] ~]# vim /etc/ssh/sshd_config
將SyslogFacility AUTHPRIV改為SyslogFacility local5
2、修改日誌程序
[[email protected] ~]#Vim /etc/syslog.conf
添加如下兩行:
# save sshd messages also to sshd.log
local5.* /data/log/sshd.log
3、重啟sshd和syslog服務
然後你可以使用ssh來登錄看看發現與sshd有關的信息都記錄到了sshd.log中。不在是messages。
4、從server02嘗試登陸server01
[[email protected] ~]# ssh server01
[email protected]‘s password:
Last login: Mon Aug 28 01:53:43 2017 from server02
[[email protected] ~]# exit
logout
Connection to server01 closed.
[[email protected] ~]#
5、查看登陸日誌
[[email protected] ~]# tail -f /data/log/sshd.log
Aug 28 01:56:30 server01 sshd[52123]: Accepted password for root from 192.168.112.141 port 54508 ssh2
Aug 28 01:56:45 server01 sshd[52123]: Received disconnect from 192.168.112.141: 11: disconnected by user
本文出自 “平平淡淡才是真” 博客,請務必保留此出處http://ucode.blog.51cto.com/10837891/1959897
修改SSHD服務日誌記錄