syslog /var/log/syslog audit /var/log/audit/audit.log journald journald ^ssh.service$ Microsoft-Windows-PowerShell/Operational eventchannel syslog /var/log/remote.log