I am exploring ways to capture the remote login events in my Linux server [ Oracle Linux 5x ]. Many users are connecting to the server using rcp and rsh protocols , I wish to capture the events [ such as- server from where they are logging, unix id, file details for rcp ]

In my syslog.conf I am capturing the following details. local7.* /var/log/ftplogs authpriv.* /var/log/sftplog

Am I missing any facilities.

  • The question(s) you have to ask yourself: are those events showing up in any of my systems current logs? If so, by which means of syslog did they get there?
    – tink
    Mar 30, 2013 at 19:19
  • I am able to get the ssh/ftp/scp events in my syslog logfiles. The issue is only with rcp and rsh
    – Balualways
    Mar 31, 2013 at 23:58
  • One wild idea is to rename and replace the rcp and rsh commands by scripts that will do the logging and then call the real command.
    – harrymc
    Apr 3, 2013 at 13:06

1 Answer 1


you need to start rshd with -L switch on server_args parameter within xinetd.conf:

service shell {
                disable        = no
                socket_type    = stream 
                wait           = no 
                user           = root
                log_on_success += USERID
                log_on_failure += USERID
                server         = /usr/sbin/in.rshd 
                server_args    = -L
  • I already have this information in my xinetd.conf
    – Balualways
    Apr 4, 2013 at 16:42
  • I have a logrotate on the log file, after the rotate few information like rsh are not being captured in the log. Looks like after each rotate I need to restart the syslog service.
    – Balualways
    Apr 4, 2013 at 16:45
  • Thanks for the details marcel - I am just curious what does the "log_on_success += USERID" will do in your xinetd.conf
    – Balualways
    Apr 4, 2013 at 16:47
  • So maybe your question's regarding logrotate not keeping to log after rotate? I know logrotate has some issues when SIGUSR1 not being sent to the PID, but I don't know for sure. Might want to google some.
    – Marcel
    Apr 4, 2013 at 20:45
  • By adding the following in the logrotate file [ postrotate ; /bin/kill -HUP cat /var/run/syslogd.pid 2> /dev/null 2> ] , The syslog started capturing the auth.info correctly which enables the rcp and rsh- Thanks
    – Balualways
    Apr 5, 2013 at 20:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.