Thank you Balazs I've added this, which seems to be working now just fine: # # Syslog Client Config Addtitions/Changes # authpriv,auth.info;local2.info /var/log/userslog authpriv,auth.notice /var/log/userslog authpriv,auth.error;local2.error /var/log/userslog authpriv,auth.*,user.notice @@syslog-NG:514 Date: Tue, 19 May 2015 21:50:47 +0200 From: bazsi77@gmail.com To: syslog-ng@lists.balabit.hu Subject: Re: [syslog-ng] Solaris & Linux (RH6) Console and SSH Use Logging Generally you'll need a filter facility (auth) but you should check that first by sending the logs. On Apr 28, 2015 7:06 PM, <wiskbroom@hotmail.com> wrote: Greetings; This is question is slightly OT, but I can't imagine a better place to ask; so please, no flames. I would like to begin logging all attempts (succesful, failed, no password given, etc) to login to Sparc/Solaris machines, as well as RedHat 6 Linux boxes. My clients are using stock syslog, but my server is running syslog-NG; my second goal is to redirect all login type logs to just one file for ALL of my Solaris & Linux servers. Does anyone have a known good syslog config file for both Solaris, and Linux? Also, a good syslog-NG entry to force just the console and ssh data into a separate file? Thank you! .vp ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq