--- title: Aggregating SSH logs into SumoLogic | daily.dev description: A tutorial for Linux administrators on aggregating SSH access logs into SumoLogic using Teleport, an SSH access solution that tracks user identity beyond... canonical: https://daily.dev/posts/aggregating-ssh-logs-into-sumologic-shugtqdgf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Aggregating SSH logs into SumoLogic | daily.dev og:description: A tutorial for Linux administrators on aggregating SSH access logs into SumoLogic using Teleport, an SSH access solution that tracks user identity beyond... og:url: https://daily.dev/posts/aggregating-ssh-logs-into-sumologic-shugtqdgf og:image: https://api.daily.dev/og/posts/ShUgtQDGF.png og:image:alt: Aggregating SSH logs into SumoLogic og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Aggregating SSH logs into SumoLogic **[Teleport](https://daily.dev/sources/teleport)** · 4 min read · 0 upvotes · 0 comments ## Summary A tutorial for Linux administrators on aggregating SSH access logs into SumoLogic using Teleport, an SSH access solution that tracks user identity beyond standard OS logins. It walks through Teleport's structured JSON event log format (session.start, session.end, auth attempts), setting up the SumoLogic Docker collector to ship these logs, configuring a sources.json file, and viewing the aggregated audit events in a SumoLogic dashboard. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What event types does Teleport log for SSH sessions? Teleport emits structured JSON events including session.start (when a user joins or creates a session), session.end (when the SSH client disconnects), and auth (authentication attempts, successful or failed). Each event includes fields like user, login, server_id, session ID, and timestamp, letting administrators trace who did what and when across their server fleet. _daily.dev surfaces practical guides like this for engineers building out SSH audit logging pipelines._ ### How do I ship Teleport SSH logs to SumoLogic? Run the official sumologic/collector:latest-file Docker image, mounting the Teleport log directory (/var/lib/teleport/log) and a sumo-sources.json file that defines a LocalFile source pointing at /var/lib/teleport/log/*.log with a category like teleport/audit. Pass SUMO_ACCESS_ID and SUMO_ACCESS_KEY as environment variables, then filter events in SumoLogic by that category. _Teams wiring up centralized SSH audit dashboards can find setup walkthroughs like this via daily.dev._ ## Similar posts on daily.dev - [Updates to Kubernetes audit logging, network flow logs, and SSH records](https://daily.dev/posts/updates-to-kubernetes-audit-logging-network-flow-logs-and-ssh-records-p1hc5y2bj) · Tailscale · 3 upvotes · 0 comments --- Tags: [#docker](https://daily.dev/tags/docker), [#logging](https://daily.dev/tags/logging), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/aggregating-ssh-logs-into-sumologic-shugtqdgf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Aggregating SSH logs into SumoLogic","url":"https://daily.dev/posts/aggregating-ssh-logs-into-sumologic-shugtqdgf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/aggregating-ssh-logs-into-sumologic-shugtqdgf"},"datePublished":"2026-08-23T12:23:30.271Z","dateModified":"2026-08-23T12:55:16.377Z","description":"A tutorial for Linux administrators on aggregating SSH access logs into SumoLogic using Teleport, an SSH access solution that tracks user identity beyond...","image":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","thumbnailUrl":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/aggregating-ssh-logs-into-sumologic-shugtqdgf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"docker,logging,ssh","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"Aggregating SSH logs into SumoLogic"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/aggregating-ssh-logs-into-sumologic-shugtqdgf#faq","mainEntity":[{"@type":"Question","name":"What event types does Teleport log for SSH sessions?","acceptedAnswer":{"@type":"Answer","text":"Teleport emits structured JSON events including session.start (when a user joins or creates a session), session.end (when the SSH client disconnects), and auth (authentication attempts, successful or failed). Each event includes fields like user, login, server_id, session ID, and timestamp, letting administrators trace who did what and when across their server fleet. daily.dev surfaces practical guides like this for engineers building out SSH audit logging pipelines."}},{"@type":"Question","name":"How do I ship Teleport SSH logs to SumoLogic?","acceptedAnswer":{"@type":"Answer","text":"Run the official sumologic/collector:latest-file Docker image, mounting the Teleport log directory (/var/lib/teleport/log) and a sumo-sources.json file that defines a LocalFile source pointing at /var/lib/teleport/log/*.log with a category like teleport/audit. Pass SUMO_ACCESS_ID and SUMO_ACCESS_KEY as environment variables, then filter events in SumoLogic by that category. Teams wiring up centralized SSH audit dashboards can find setup walkthroughs like this via daily.dev."}}]} ```