在 CentOS 上更改 sshd 日志文件位置？

Question

如何更改sshdCentOS 上的日志文件位置？sshd记录到/var/log/messages而不是/var/log/secure. 如何更改设置以便sshd停止向 发送日志/var/log/messages？

Answer 1

请张贴你的sshd_config其他东西似乎是了。一个普通的 CentOS 系统总是登录到/var/log/secure.

例子

$ sudo tail -f /var/log/secure
Feb 18 23:23:34 greeneggs sshd[3545]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Feb 18 23:23:36 greeneggs sshd[3545]: Failed password for root from ::1 port 46401 ssh2
Feb 18 23:23:42 greeneggs unix_chkpwd[3555]: password check failed for user (root)
Feb 18 23:23:42 greeneggs sshd[3545]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Feb 18 23:23:43 greeneggs sshd[3545]: Failed password for root from ::1 port 46401 ssh2
Feb 18 23:23:48 greeneggs sshd[3545]: Accepted password for root from ::1 port 46401 ssh2
Feb 18 23:23:48 greeneggs sshd[3545]: pam_unix(sshd:session): session opened for user root by (uid=0)
Feb 18 23:24:05 greeneggs sshd[3545]: Received disconnect from ::1: 11: disconnected by user
Feb 18 23:24:05 greeneggs sshd[3545]: pam_unix(sshd:session): session closed for user root
Feb 18 23:27:15 greeneggs sudo:     saml : TTY=pts/3 ; PWD=/home/saml ; USER=root ; COMMAND=/bin/tail /var/log/secure

这是通过/etc/ssh/sshd_config以下方式控制的：

# Logging
# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
SyslogFacility AUTHPRIV
#LogLevel INFO

以及以下内容/etc/rsyslog.conf：

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

你的问题

在您的评论之一中，您提到您的rsyslogd配置文件名为/etc/rsyslog.config. 这不是该文件的正确名称，可能是您的日志记录被搞砸的原因。将此文件的名称更改为/etc/rsyslog.conf，然后重新启动日志记录服务。

$ sudo service rsyslog restart