• /etc/ssh/sshd_config
# SyslogFacility AUTH
SyslogFacility LOCAL5
LogLevel DEBUG3
  • /etc/rsyslog.d/sshd.conf
local5.*    /var/log/sshd.log
  • /etc/logrotate.d/syslog
/var/log/sshd.log
{
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
endscript
}
systemctl restart sshd rsyslogd