Where to find SSH Login log files on centos
I have shared a .pem file with few a developers and now something went wrong on the server. I would like to track logins in a log so that I can see who (IP) made changes and when (if even possible) what all change happened in that session.
I tried looking /var/logs/auth.log, I cannot find such file in my machine.
Few more details:
Hosted on AWS Created and shared .pem file CentOS - centos-release-7-2.1511.el7.centos.2.10.x86_64 EC2 instance I have not set flow log Can someone help to track SSH login details ?
On CentOS login information is logged in /var/log/secure
, not /var/logs/auth.log
.
In Centos 7 the SSH logs are located at "/var/log/secure"
If you want to monitoring in real time, you may use the tail command as shown below:
tail -f -n 50 /var/log/secure | grep sshd