I'm just wondering about the best way to filter my sshd logs. The problem is that I monitor my boxes over SSH using Nagios and Cacti. They both connect every 5 mins and this clogs up my log files with loads of entries making it difficult to do a quick 'tail' to see what's going on.

I'd like to have all logins from my monitoring user (on a specific IP) logged in a separate file.

Ideally I'd avoid installing syslog-ng or similar. I would have to set this up on a variety of Ubuntu, CentOS and FreeBSD machines (running a variety of OpenSSH versions), so it will make life easier if I can do this without additional software.

Any recommendations on how to achieve this?



You could do something like this:

tail -f logfile | grep -v "some\.ip\.address\.to\.ignore"


tail -f logfile | grep -v "some\.ip\.address\.to\.ignore.*user-name"

you could pass your syslog file to pipe like this

mkfifo /var/log/pipes/pipe1

and then

read that with script that will remove strings you don't want like this:

cat /var/log/pipes/pipe1 | grep -v "login from xxx.xxx.xxx" | while read LINE
  echo $LINE >>/var/log/ssh.log
  • aha! yep that's more or less what i was looking for. something not requiring extra packages or a huge amount of setup. although maybe i should also be thinking about more advanced analysis and intrusion detection such as ossec. cheers everyone! – samuelkf Jul 19 '10 at 15:59
  • we are company making log analysis software for ISP's :) – damir Jul 21 '10 at 9:56

Yoy can try ossec, it has a very good log analysis.


Swatch is a good program for tailing and filtering log files, even supporting colorizing lines. There's a Debian/Ubuntu package for it too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.