Is it possible to view all ssh logs of a deleted user ?

When the user is deleted, the logs are still kept.  Although it’s not directly searchable with the username from the Ezeelogin web panel because the user is not listed in the drop-down,  you can search with other parameters such as server hostname  and date range.

Alternately, you can find the raw logs on your ssh jumphost box

/var/log/ezlogin/full/{username}/

You can  read the logs as plain text provided the SSH log encryption was not enabled at the time the ssh log was recorded.

0 (0)
Article Rating (No Votes)
Rate this article
    Attached Files
    There are no attachments for this article.
    Related Articles RSS Feed
    How to enable Public key based authentication and Allow root login in SSHD
    Viewed 1264 times since Fri, Dec 8, 2017
    How does the license upgrade work?
    Viewed 1169 times since Mon, Aug 21, 2017
    How to stream the ssh sessions in real time?
    Viewed 2760 times since Wed, Nov 22, 2017
    Add servers behind a Tunnel Host in SSH Gateway or Add servers that are accessible via port forwarding via the ssh gateway server.
    Viewed 2072 times since Wed, Jan 17, 2018
    Where is my data stored?
    Viewed 1135 times since Mon, Aug 21, 2017
    Add custom fields on server add form
    Viewed 300 times since Wed, Mar 27, 2019
    What are the outbound ports that needs to be opened for fetching the license?
    Viewed 1120 times since Mon, Aug 21, 2017
    Installing Jump server or Bastion host on a linux host in Google or AWS instance ?
    Viewed 2217 times since Thu, Sep 21, 2017
    How to find the ssh jumphost software version that is being run?
    Viewed 1081 times since Thu, Mar 1, 2018
    Can I use Google 2FA, Yubikey , DUO simultaneously?
    Viewed 2249 times since Thu, Dec 14, 2017