For CentOS v8 Linux, where and how can I get the event logs for the:

  1. Failed SSH (port TCP/22) connection
  2. Failed sudoers

Thank you in advance.

  • 2
    Did you re-enable rsyslog as recommended a few days ago? – Michael Hampton Aug 28 at 4:19
  • 1
    @MichaelHampton personalized service! That's great! – e2-e4 Aug 28 at 4:21
  • 1
    See this as well. You should really follow the advice from qualified contributors here, who are, hem, what's better than "senior", well, "Sensei" System Engineers... – e2-e4 Aug 28 at 4:27
  • 1
    No, there are logs, i.e. the journal, but as I said the other day they aren't persistent by default. You have to take some action to get persistent logging, whether it's using rsyslog, or shipping journal entries somewhere else. The journal does have logs of failed sudo and ssh connections but they are far more detailed than would normally be useful, and sorting out the useful entries turns out to be a bit painful. Looking through files created by rsyslog turns out to be a lot easier. – Michael Hampton Aug 28 at 4:29
  • 1
    Thank you as well to @e2-e4 for the suggestion. – Senior Systems Engineer Aug 28 at 4:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.