Solved SSHD logging

[byrnejb]

tl;dr Use: <cmd>last</cmd>

OP
I am looking in auth.log and can find entries for session starts ( Accepted password for <userid> ). However, I do not see any entries for the corresponding logouts. The logging level in sshd_config is set to the default ( info). SO, how does one insure that ssh session terminations are logged?

 

[Kai Burghardt]

[…] However, I do not see any entries for the corresponding logouts. […]

Arguably one does not need to perform any authentication to logout, but there are disconnect entries.​

[…] how does one insure that ssh session terminations are logged?

You read /var/log/utx.log with utilities such as getent(1) or last(1)​

last -t $(seq -f 'pts/%g' 0 99) # use --libxo for machine-readable output

or the utmpx(3) library functions. This gives you an accurate picture of all logins and logouts.​

 

[byrnejb]

I found last though google. That gives me everything I needed to resolve this issue.