Monitoring ssh logins/logouts

Jakob Curdes jc at
Wed Apr 6 20:40:37 EST 2005


we are trying to monitor ssh logins on security-critical machines with a 
script that scans logfiles for the relevant entries.
A problem ist that when the ssh connection is closed by a network 
interruption or by closing the window with the ssh client, we do not 
find a corresponding entry in the logs.  "last" does not show this 
information either, at least on our systems which are RedHat Linux 
based. Is there any way to record a "User gone" or so ? At a certain 
point, the daemon closes the connection when the client has gone away; 
would it be possible to log this ?

I would be grateful for a hint.

Jakob Curdes

More information about the openssh-unix-dev mailing list