how do i access the ssh logs history that was recorded for the ssh user ?
Viewing SSH Logs History for an SSH Gateway User in the Ezeelogin Web GUI.
Overview: This article describes how to view SSH logs history for an SSH gateway user in the Ezeelogin web panel , detailing steps from configuring logging settings to accessing and reviewing logs both through the web interface and directly from the backend directory.
.png)
Do refer to the article: Record SSH sessions
Ezeelogin provides a comprehensive way to record and view SSH session logs for users accessing through an SSH gateway. Ezeelogin’s SSH logging feature provides both a user-friendly web interface for accessing session logs and direct backend access for more detailed management and review. By following these steps, administrators can effectively monitor and review SSH activities conducted through their gateway, ensuring security and compliance with logging policies.
Here’s how you can access and view these logs:
Step 1: Configure SSH Logging Settings
First, ensure that SSH logging is enabled and configured correctly in your Ezeelogin web panel. You can set this up under Settings -> General -> Security -> SSH Logging.
The output is directed to the desired location, typically /var/log/ezlogin/.
Step 2: Accessing SSH Logs
To view the recorded SSH session logs: Navigate to Users -> SSH Log in the Ezeelogin web interface. Here, you can specify the user ('riyas') for whom you want to view the logs.
Step 3: Filtering Logs
Set the date range using the 'From' and 'To' fields. Click on 'Find' to search for logs within the specified date range.
After finding the logs, matching results will be displayed. Click on the 'View' button corresponding to the log entry you want to inspect.
The SSH recordings are viewed as follows:
Additionally, SSH logs are stored in the /var/log/ezlogin/ directory on the backend server.
You can also access these logs directly from the Ezeelogin web interface under Users -> SSH LOGS / SCP LOGS.
FAQ
1. Why are SSH log files (Users → SSH Logs in the Ezeelogin GUI) still present after deletion from the web interface?
Deleting log entries from the Ezeelogin web interface only removes the metadata from the database. The actual log files stored on the filesystem under /var/log/ezlogin/ are not deleted.
To restore the metadata for these logs back into the web interface, use the following command:
root@gateway: /usr/local/ezlogin/eztool.php -reimport_logs
This command re-imports the log metadata from the log files that still exist on disk.
2. Is there any impact if the logs in /var/log/ezlogin/ are deleted?
No, the logs in /var/log/ezlogin/ can be safely deleted without affecting system functionality. However, once deleted, these logs cannot be recovered.
Related Articles:
View the SSH log of all users.
Strange character in the SSH log recording.