Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have setup the syslog-ng daemon using Cygwin in Windows 7. What I want to do is to log all of the ssh failed passwords, etc to /var/log/sshd.log. I tried to do this by adding the following line:

auth.* /var/log/sshd.log

to /etc/syslog.conf

However, all the ssh info gets logged to /var/log/messages and sshd.log is empty. I have been searching net for long time, but cant find a solution. Help would be much appreciated.

share|improve this question
up vote 2 down vote accepted

That's the old sysklogd conf file syntax (and file path).

Syslog-ng looks (by default) at /etc/syslog-ng.conf

The manpage for that file is here:

A basic filter for ssh messages to go to a separate file would look like

destination ssh { file("/var/log/ssh.log"); };
filter f_ssh { program("sshd"); };
log { source(src); filter(f_ssh); destination(ssh); };

in /etc/syslog-ng.conf

share|improve this answer

HERE are some more details setting up Syslog-ng.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.