Solaris restart syslog configure separate authentication log

  

Add the following line in /etc/syslog:

auth.info /var/log/secure //record authentication information

Down, you need to restart the syslog operation

#svcadm restart system-log

#cat /var/log/secure


May 25 13 :58:33 zhao-file sshd[893]: [ID 800047 auth.info] Accepted password for ckl from 180.168.81.54 port 53705 ssh2

May 25 13:59:45 zhao-file sshd[909] : [ID 800047 auth.info] Accepted publickey for ckl from 180.168.81.54 port 53706 ssh2

May 25 14:01:18 zhao-file sshd[938]: [ID 800047 auth.info] Did not receive Identification string from 61.151.248.196

May 25 14:03:28 zhao-file sshd[911]: [ID 800047 auth.info] Received disconnect from 180.168.81.54: 0:

May 25 14:03:32 zhao-file sshd[895]: [ID 800047 auth.info] Received disconnect from 180.168.81.54: 0:
zh-CN"],null,[0.98549217],zh-CN"]]]

Copyright © Windows knowledge All Rights Reserved