I am exploring ways to capture the remote login events in my Linux server [ Oracle Linux 5x ]. Many users are connecting to the server using rcp and rsh protocols , I wish to capture the events [ such as- server from where they are logging, unix id, file details for rcp ]
In my syslog.conf I am capturing the following details. local7.* /var/log/ftplogs authpriv.* /var/log/sftplog
Am I missing any facilities.