Sample Header Ad - 728x90

SSH logging to external syslog server

1 vote
0 answers
49 views
I am using CentOS 10, and I am trying to send the SSH logs to an external syslog server listening on port UDP 514. I changed the default logging facility of sshd to local2 and tested it locally and it works. root@localhost:~# cat /etc/ssh/sshd_config.d/50-redhat.conf SyslogFacility LOCAL2 Local2 logs to /var/log/test.log: local2.* /var/log/test.log The logs are written correctly: root@localhost:~# cat /var/log/test.log Jun 27 00:07:15 localhost sshd-session: Failed password for juanb from 10.211.1.2 port 57465 ssh2 Jun 27 00:07:15 localhost sshd-session: Failed password for juanb from 10.211.1.2 port 57465 ssh2 However, after testing that the change of facilities works, I tried to configure rsyslog so all messages from facility LOCAL2 are sent to the external syslog server: #Log SSH login messages to external syslog server local2.* action(type="omfwd" queue.type="LinkedList" queue.filename="ssh_fwd" action.resumeRetryCount="-1" queue.saveonshutdown="on" Target="10.211.1.2" Port="514" Protocol="udp" ) I added this at the end of /etc/rsyslog.conf but is not working.
Asked by Juan Alejandro (11 rep)
Jun 27, 2025, 07:13 AM
Last activity: Jul 9, 2025, 06:47 PM