SSH sessions record logs in the following plain-text files.

/var/log/secure
/var/log/messages

These logs can be browsed:

Each log entry has the following syntax.

<timestamp> <hostname> <application>[<processId>] <message>

Where each field has the following value.

Field

Value

​<timestamp>

​The time of the recorded event, in Mmm dd hh:mm:ss format

<hostname>

The system hostname

<application>

The application name: sshd for the SSH daemon, sudo for the sudo command, systemd for the systemd init system

<processId>

The process identifier

<message>

The log message with details on the recorded event

For example:

Login logs saved in /var/log/secure
May 14 07:03:28 node00 sshd[1401109]: pam_unix(sshd:session): session opened for user sysadmin by (uid=0)
May 14 07:03:28 node00 sshd[1401109]: User child is on pid 1401153
May 14 07:03:29 node00 sshd[1401153]: Starting session: shell on pts/6 for sysadmin from <HOST_IP> port 51616 id 0
systemd messages saved in /var/log/messages
May 14 06:48:34 node00 systemd-logind[1035]: New session 20 of user sysadmin.
May 14 06:48:34 node00 systemd[1]: Started Session 20 of user sysadmin.
May 14 07:03:26 node00 systemd[1]: session-20.scope: Succeeded.
Logout logs saved in /var/log/secure
May 14 07:03:26 node00 sshd[1399659]: Received disconnect from <HOST_IP> port 50924:11: disconnected by user
May 14 07:03:26 node00 sshd[1399659]: Disconnected from user sysadmin <HOST_IP> port 50924
May 14 07:03:26 node00 sshd[1399655]: pam_unix(sshd:session): session closed for user sysadmin
Systemd messages saved in /var/log/messages
May 14 07:03:26 node00 systemd-logind[1035]: Session 20 logged out. Waiting for processes to exit.
May 14 07:03:26 node00 systemd-logind[1035]: Removed session 20.