Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm just wondering about the best way to filter my sshd logs. The problem is that I monitor my boxes over SSH using Nagios and Cacti. They both connect every 5 mins and this clogs up my log files with loads of entries making it difficult to do a quick 'tail' to see what's going on.

I'd like to have all logins from my monitoring user (on a specific IP) logged in a separate file.

Ideally I'd avoid installing syslog-ng or similar. I would have to set this up on a variety of Ubuntu, CentOS and FreeBSD machines (running a variety of OpenSSH versions), so it will make life easier if I can do this without additional software.

Any recommendations on how to achieve this?

Thanks!

share|improve this question
add comment

4 Answers 4

Yoy can try ossec, it has a very good log analysis.

share|improve this answer
add comment

You could do something like this:

tail -f logfile | grep -v "some\.ip\.address\.to\.ignore"

or

tail -f logfile | grep -v "some\.ip\.address\.to\.ignore.*user-name"
share|improve this answer
add comment

Swatch is a good program for tailing and filtering log files, even supporting colorizing lines. There's a Debian/Ubuntu package for it too.

share|improve this answer
add comment

you could pass your syslog file to pipe like this

mkfifo /var/log/pipes/pipe1

and then

read that with script that will remove strings you don't want like this:

cat /var/log/pipes/pipe1 | grep -v "login from xxx.xxx.xxx" | while read LINE
do
  echo $LINE >>/var/log/ssh.log
done
share|improve this answer
    
aha! yep that's more or less what i was looking for. something not requiring extra packages or a huge amount of setup. although maybe i should also be thinking about more advanced analysis and intrusion detection such as ossec. cheers everyone! –  samuelkf Jul 19 '10 at 15:59
    
we are company making log analysis software for ISP's :) –  damir Jul 21 '10 at 9:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.