[root@rH7-1 ~]# cat /var/log/secure
Jan  3 20:39:18 rH7-1 sshd[10878]: Accepted password for lczmx from 192.168.255.1 port 19375 ssh2

# 在/etc/rsyslog.conf中加入
*.*                                     /var/log/all.log

# 在/var/log下创建all.log
touch all.log

# 用ssh登录到该主机，然后查看日志，假如没有信息，可以restart一下rsyslog.service

grep "sshd" /var/log/all.log 

Jan  5 13:28:26 rH7-1 sshd[10428]: Received disconnect from 192.168.255.1 port 2226:11: disconnected by user
Jan  5 13:28:26 rH7-1 sshd[10428]: Disconnected from 192.168.255.1 port 2226
Jan  5 13:28:26 rH7-1 sshd[10424]: pam_unix(sshd:session): session closed for user lczmx
Jan  5 13:28:29 rH7-1 sshd[10562]: Accepted password for lczmx from 192.168.255.1 port 2248 ssh2
Jan  5 13:28:30 rH7-1 sshd[10562]: pam_unix(sshd:session): session opened for user lczmx by (uid=0)

# see "man logrotate" for details
# rotate log files weekly 每周对日志进性一次轮替
weekly

# keep 4 weeks worth of backlogs 保存多少份
rotate 4

# create new (empty) log files after rotating old ones 在日志轮替后，创建新的空的日志文件
create

# use date as a suffix of the rotated file 使用日期作为日志轮替文件后缀
dateext

# uncomment this if you want your log files compressed 日志文件是否压缩，不注释即为压缩
#compress

# RPM packages drop log rotation information into this directory
# 下面是配置某个日志文件，可以写在这里，也可以写在/etc/logrotate.d

include /etc/logrotate.d

# no packages own wtmp and btmp -- we'll rotate them here
/var/log/wtmp {
    monthly
    create 0664 root utmp # 664权限，所有者：root，所属组：utmp
	minsize 1M	# 文件最小轮替大小
    rotate 1	# 仅保留一份
}

/var/log/btmp {
    missingok	# 日志不存在则忽略
    monthly
    create 0600 root utmp
    rotate 1
}

# system-specific logs may be also be configured here.

#!/bin/sh

/usr/sbin/logrotate -s /var/lib/logrotate/logrotate.status /etc/logrotate.conf
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
    /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
fi
exit 0