Log ssh sessions to rsyslog

You'll need to do two sequential filters rather than both on one line.

:msg, contains, "some-text"
if $syslogfacility-text == "facility" then /var/log/somelog.log
~

Edit:

I take that back. I have seen it done both ways now. I just found this example in the rsyslog Wiki that should be able to be adapted.

if $programname == 'popa3d' and $syslogseverity <= '6' then /var/log/popa3d.log

You of course will substitute your conditions in to the example.

if $syslogfacility-text == 'local0' and $msg contains 'some-text' then /var/log/somelog.log
& ~

Rsyslog Wiki
Rsyslog Docs

You could do it in three different ways as i see it - There are most likely many other ways to do it as well! The best method would be to attach a audit tool to the kernels sysexec calls so it would be untraceable by the user etc. The two other ways would simply be to modify the shell environment to log it.

Instead of me (grabbing the code/answers from google) showing you how to do it. I will give you links to sites that have explained this detailed already. I hope it's exactly what you need.

Btw, the easiest way is by far just to include something in your main bashrc/profile to affect all users.

Anyway's, here are links to bashrc solutions.

1) Bashrc solution: How to log commands executed by all the users in Linux? 2) Bashrc/trap solution: Bash: History to Syslog

The other way (kernel level) would be to look into to tools audit or acct. There are many sites out there who tell you how to setup logging of commands via kernel sysexec calls.