Filtering SSHD Logs

Question

I'm just wondering about the best way to filter my sshd logs. The problem is that I monitor my boxes over SSH using Nagios and Cacti. They both connect every 5 mins and this clogs up my log files with loads of entries making it difficult to do a quick 'tail' to see what's going on.

I'd like to have all logins from my monitoring user (on a specific IP) logged in a separate file.

Ideally I'd avoid installing syslog-ng or similar. I would have to set this up on a variety of Ubuntu, CentOS and FreeBSD machines (running a variety of OpenSSH versions), so it will make life easier if I can do this without additional software.

Any recommendations on how to achieve this?

Thanks!

Answer 1

you could pass your syslog file to pipe like this

mkfifo /var/log/pipes/pipe1

and then

read that with script that will remove strings you don't want like this:

cat /var/log/pipes/pipe1 | grep -v "login from xxx.xxx.xxx" | while read LINE
do
  echo $LINE >>/var/log/ssh.log
done

Answer 2

Yoy can try ossec, it has a very good log analysis.

Answer 3

You could do something like this:

tail -f logfile | grep -v "some\.ip\.address\.to\.ignore"

or

tail -f logfile | grep -v "some\.ip\.address\.to\.ignore.*user-name"

Answer 4

Swatch is a good program for tailing and filtering log files, even supporting colorizing lines. There's a Debian/Ubuntu package for it too.