# SSH events in balenaOS?

**URL:** <https://forums.balena.io/t/ssh-events-in-balenaos/269034>\
**Category:** balenaOS\
**Created:** [March 10, 2021, 2:34pm UTC](https://forums.balena.io/t/ssh-events-in-balenaos/269034 "2021-03-10T14:34:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![barryjump](https://avatars.discourse-cdn.com/v4/letter/b/bc8723/32.png) [@barryjump](https://forums.balena.io/u/barryjump)\
**Post date:** [March 10, 2021, 2:34pm UTC](https://forums.balena.io/t/ssh-events-in-balenaos/269034/1 "2021-03-10T14:34:38Z")

</div>

I’m interested in logging SSH events (particularly login/auth events) in monitoring service. I’ve check the web and found a few resources about where sshd logs are typically stored, but had trouble finding them in my root balenaOS.  
Ideally I was hoping to do a little script like this: [Capturing SSH logins with Datadog events - Matthew Green](https://thematthewgreen.com/post/ssh-logins-with-datadog/) to start, but the event isn’t firing for some reason and I don’t think its on Datadogs side.

I’m guessing perhaps there are some particular ways in which balena handles these?

Any tips on which folders to look in or what services could output a log around ssh events? Does it get a little screwy when multiple containers are involved consider each has its own ssh service?  
Thanks 👍

---

<div class="post-metadata">

**Author:** ![majorz](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/majorz/32/639_2.png) [@majorz](https://forums.balena.io/u/majorz)\
**Post date:** [March 10, 2021, 3:24pm UTC](https://forums.balena.io/t/ssh-events-in-balenaos/269034/4 "2021-03-10T15:24:43Z")

</div>

You may hook to the journalctl supervisor endpoint we provide and watch for SSH events from there: [Journald logs](https://www.balena.io/docs/reference/supervisor/supervisor-api/#journald-logs). For test you may login to a device through the web dashboard and follow the logs with `journalctl -f`. When you connect with another terminal you should see the events printed there. You will need to process and parse those from an application container using the balena supervisor API listed above.

---

<div class="post-metadata">

**Author:** ![barryjump](https://avatars.discourse-cdn.com/v4/letter/b/bc8723/32.png) [@barryjump](https://forums.balena.io/u/barryjump)\
**Post date:** [March 10, 2021, 4:05pm UTC](https://forums.balena.io/t/ssh-events-in-balenaos/269034/6 "2021-03-10T16:05:33Z")

</div>

Perfect thank you! Works like a charm.