Skip to Content

Is it possible to view all ssh logs of a deleted user ?

When the user is deleted, the logs are still kept.  Although it’s not directly searchable with the username from the Ezeelogin web panel because the user is not listed in the drop-down,  you can search with other parameters such as server hostname  and date range.

Alternately, you can find the raw logs on your ssh jumphost box

/var/log/ezlogin/full/{username}/

You can  read the logs as plain text provided the SSH log encryption was not enabled at the time the ssh log was recorded.