Logging ssh access attempts

[Kreno]

Hello all,

I would like to log ssh log-in attempts to Cisco router, Cisco ASA and two Opensolaris computers into separate file. Does anybody have example on how to achieve it? Current syslog-ng is configured that all data is stored in one file.

Thank you and kind regards,
 M

[Admin]

Code:

source s_net { udp(); };
destination d_hosts {
   file("/var/log/$HOST.log";
  };
log { source(s_net); destination(d_hosts); };

That will put the messages from each host into a separate file. 

[Kreno]

I have all host is separate log files. What I would like to achieve is that only ssh attempts would be logged into for example ssh-log.log file.

[Admin]

try this:

Code:

source s_net { udp(); };
filter f_ssh { match("ssh"); };
destination d_hosts { file("/var/log/$HOST.log";  };
log { source(s_net); filter(f_ssh); destination(d_hosts); };

This will only log events that contain the string "ssh" to the files.  You may need to adjust the filter based on what events you want to see.