Forum Discussion
Kevin_Stewart
Mar 26, 2014Employee
At the very least:
when CLIENT_ACCEPTED {
log local0. "Request for service at port [TCP::local_port] from [IP::client_addr]"
}
That should log the client source address for any incoming TCP session, but it will not log the usernames/passwords in the SSH sessions.