Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm just wondering about the best way to filter my sshd logs. The problem is that I monitor my boxes over SSH using Nagios and Cacti. They both connect every 5 mins and this clogs up my log files with loads of entries making it difficult to do a quick 'tail' to see what's going on.

I'd like to have all logins from my monitoring user (on a specific IP) logged in a separate file.

Ideally I'd avoid installing syslog-ng or similar. I would have to set this up on a variety of Ubuntu, CentOS and FreeBSD machines (running a variety of OpenSSH versions), so it will make life easier if I can do this without additional software.

Any recommendations on how to achieve this?


share|improve this question

you could pass your syslog file to pipe like this

mkfifo /var/log/pipes/pipe1

and then

read that with script that will remove strings you don't want like this:

cat /var/log/pipes/pipe1 | grep -v "login from" | while read LINE
  echo $LINE >>/var/log/ssh.log
share|improve this answer
aha! yep that's more or less what i was looking for. something not requiring extra packages or a huge amount of setup. although maybe i should also be thinking about more advanced analysis and intrusion detection such as ossec. cheers everyone! – samuelkf Jul 19 '10 at 15:59
we are company making log analysis software for ISP's :) – damir Jul 21 '10 at 9:56

Yoy can try ossec, it has a very good log analysis.

share|improve this answer

You could do something like this:

tail -f logfile | grep -v "some\.ip\.address\.to\.ignore"


tail -f logfile | grep -v "some\.ip\.address\.to\.ignore.*user-name"
share|improve this answer

Swatch is a good program for tailing and filtering log files, even supporting colorizing lines. There's a Debian/Ubuntu package for it too.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.