SSH sessions record logs in the following plain-text files.
/var/log/secure/var/log/messagesThese logs can be browsed:
- Using the Grafana console, as explained in Browsing log files with Grafana.
- Using an external SIEM server, as explained in Browsing logs with a SIEM.
Each log entry has the following syntax.
<timestamp> <hostname> <application>[<processId>] <message>Where each field has the following value.
Field | Value |
|---|---|
<timestamp> | The time of the recorded event, in |
<hostname> | The system hostname |
<application> | The application name: |
<processId> | The process identifier |
<message> | The log message with details on the recorded event |
For example:
Login logs saved in /var/log/secure
May 14 07:03:28 node00 sshd[1401109]: pam_unix(sshd:session): session opened for user sysadmin by (uid=0)May 14 07:03:28 node00 sshd[1401109]: User child is on pid 1401153May 14 07:03:29 node00 sshd[1401153]: Starting session: shell on pts/6 for sysadmin from <HOST_IP> port 51616 id 0systemd messages saved in /var/log/messages
May 14 06:48:34 node00 systemd-logind[1035]: New session 20 of user sysadmin.May 14 06:48:34 node00 systemd[1]: Started Session 20 of user sysadmin.May 14 07:03:26 node00 systemd[1]: session-20.scope: Succeeded.Logout logs saved in /var/log/secure
May 14 07:03:26 node00 sshd[1399659]: Received disconnect from <HOST_IP> port 50924:11: disconnected by userMay 14 07:03:26 node00 sshd[1399659]: Disconnected from user sysadmin <HOST_IP> port 50924May 14 07:03:26 node00 sshd[1399655]: pam_unix(sshd:session): session closed for user sysadminSystemd messages saved in /var/log/messages
May 14 07:03:26 node00 systemd-logind[1035]: Session 20 logged out. Waiting for processes to exit.May 14 07:03:26 node00 systemd-logind[1035]: Removed session 20.