View SSH logs of all users
How to view SSH logs of all users?
Overview: This article explains how to enable a user to view SSH logs of all users in Ezeelogin by configuring user actions and granting the necessary privileges on remote servers.
If a particular user needs to view SSH logs of all users then you need to enable User List and View SSH Log for that user under user action.
Access Control->User Action->Users->User List, View SSH Log. After saving, refresh the Ezeelogin GUI of the user to reflect the changes. You can refer below screenshot
Also, you should grant privileges to the remote servers for the same user to view the logs from that server. If a user has no access to a remote server, then the user will not be able to view the SSH logs of that server.
.jpg)
Refer below screenshot where Ezeelogin user 'Mike' is able to view SSH logs of all users
FAQ
1. Why are SSH log files (Users → SSH Logs in the Ezeelogin GUI) still present after deletion from the web interface?
Deleting log entries from the Ezeelogin web interface only removes the metadata from the database. The actual log files stored on the filesystem under /var/log/ezlogin/ are not deleted.
To restore the metadata for these logs back into the web interface, use the following command:
root@gateway:/usr/local/ezlogin/eztool.php -reimport_logs
This command re-imports the log metadata from the log files that still exist on disk.
2. Is there any impact if the logs in /var/log/ezlogin/ are deleted?
No, the logs in /var/log/ezlogin/ can be safely deleted without affecting system functionality. However, once deleted, these logs cannot be recovered.
Related Articles:
how do i access the ssh logs history that was recorded for the ssh user ?
Is it possible to view all ssh logs of a deleted user ?