# sshd logging [solved]

## radonx86

i used to have a script that sent me data from my ssh logs so i could keep an eye on it in case of any strange activity. It got the log data from /var/log/sshd. I recently installed gentoo on a new system and the /var/log/sshd directory doesn't exist. i've used locate, etc. to try to find some log files, but I am not having any luck. I also checked /etc/sshd/sshd_config and verified that logging level is set to default, but i don't see anything about where the log files are located. am i retarded? where are my log files? please help.

thanks.

----------

## mudrii

all ssh activities are logged in /var/log/messages

depends what log manager you using you could configure to log all ssh in different file.

----------

## RaceTM

I use metalog for my system log, and the config file is /etc/metalog.conf (I thnk).  in there you can set the default log file location for sshd.  If you use another system log program, you just need to find its config file and do the same.

Hope this helps

----------

## Suicidal

For syslog-ng it would be:

```
destination sshd { file("/var/log/sshd.log"perm(0640)group(logaudit)); };

filter f_sshd {match("^sshd.*"); };

#sshd

log { source(src); filter(f_sshd); destination(sshd); };
```

logaudit is a custom group might want to change it to your own or adm for viewing log files as non root.

----------

## radonx86

worked like a charm. thanks.

----------

## GNUtoo

please add [solved] to your post

----------

