监控 aix ssh log

最近客户的 监控软件不能 ssh2 到 目标主机，

用如下方法监控：

 

**********************************************
1. assign the log file for auth logging
# touch /var/adm/auth.log
# chmod 640 /var/adm/auth.log

2. turn on auth logging
# vi /etc/syslog.conf
Append the following line to the bottom:
auth.debug /var/adm/auth.log
Save, Exit, then:
# refresh –s syslogd

3: 看auth.log:

截取一部份：

Jan 28 10:43:04 hgpsfe01 auth|security:info sshd[1597562]: Accepted password for patrol from 146.215.127.94 port 55753 ssh2
Jan 28 10:43:04 hgpsfe01 auth|security:info sshd[946560]: Disconnecting: Remote login for account patrol is not allowed.
Jan 28 10:46:19 hgpsfe01 auth|security:info sshd[2503044]: Accepted password for patrol from 146.215.127.94 port 55873 ssh2
Jan 28 10:46:20 hgpsfe01 auth|security:crit sshd[2875396]: fatal: Couldn't wait for child: There are no child processes.
Jan 28 10:46:20 hgpsfe01 auth|security:crit sshd[2875398]: fatal: Couldn't wait for child: There are no child processes.

 

可以看到哪个ip connect with the server.

 

------------

至于linux 的情况，可以 test 一下。