Similar to ssh, for fail2ban. Something like this will do :
May 24 10:52:45 dargor sshd[${pid}]: Disconnecting: Too many authentication failures for invalid user ${login} from ${ip} port ${port} ssh2 [preauth]
May 24 11:05:56 dargor sshd[${pid}]: Received disconnect from ${ip}: 11: Bye Bye [preauth]
May 24 11:21:28 dargor sshd[${pid}]: Connection closed by ${ip} [preauth]
May 24 12:13:06 dargor sshd[${pid}]: Accepted publickey for ${login} from ${ip} port ${port} ssh2: RSA ${fingerprint}
May 24 12:13:06 dargor sshd[${pid}]: Received disconnect from ${ip}: 11: disconnected by user
Either with syslog or a file to /var/log.
Similar to ssh, for fail2ban. Something like this will do :
Either with syslog or a file to /var/log.