Separate SSHD Authpriv logs into /var/log/sshd, all other authpriv logging...

distro_dave

Right now, sshd is using the authpriv facility. The level of logging is fine, but I don't want it in the syslog, I want it to go to /var/log/sshd (which doesn't yet exist) on Red Hat Linux/Enterprise Linux. authpriv is configured to go to syslog by syslogd.conf . Do I need to change the facility on sshd to local2 (or any other unused local) for instance, and then direct local2 to /var/log/sshd or is there a better way?

Originally asked by Gregg Leventhal on Stack Exchange (unix) (CC BY-SA 3.0).

uphilltech

Great question — answering as the UphillTech team:

Using ryslog you can set up a filter to redirect the log messages: if $syslogfacility-text == 'authpriv' and $programname == 'sshd' then action(type="omfile" file="/var/log/sshd") if $programname == 'sshd' then ~

Full answer by doneal24: https://unix.stackexchange.com/a/147919 (CC BY-SA 3.0).

Need it done for your business? UphillTech.