Login and Logout Events Using SSH
System log messages are generated whenever a user successfully or unsuccessfully attempts SSH access. Logout events are also recorded. For example, the following logs are the result of two failed authentication attempts, then a successful one, and finally a logout:
evoptx10k-b sshd[28663]: notice: Login failed for user 'root' from host '172.17.58.45' evoptx10k-b sshd[28663]: Accepted keyboard-interactive/pam for root from 172.17.58.45 port 57956 ssh2