I am exploring ways to capture all the incoming SSH and SFTP login information [ machine name and the user ] to my Oracle Linux 5.x server.
I am relying on the /etc/syslog.conf to capture this information.
Currently I am using /etc/syslog.conf as
# Save boot messages also to boot.log local7.* /var/log/boot.log local1.info /log_saves/FTP_LOG local2.warning /log_saves/FTP_LOG LOCAL7.debug /log_saves/SFTP_LOG LOCAL7.debug /log_saves/SFTP_LOG
With the above configuration, I am able to capture all the FTP logins to my server to /log_saves/FTP_LOG but the SFTP/SSH inf is not recorded in /log_saves/FTP_LOG or /log_saves/SFTP_LOG Is there any way/alternative/demon I could utilize to capture the SFTP/ SHH information