---
title: SSH command logs
description: Review SSH commands a user ran on a target.
image: https://developers.cloudflare.com/zt-preview.png
---

[Skip to content](#%5Ftop) 

Was this helpful?

YesNo

[ Edit page ](https://github.com/cloudflare/cloudflare-docs/edit/production/src/content/docs/cloudflare-one/insights/logs/dashboard-logs/ssh-command-logs.mdx) [ Report issue ](https://github.com/cloudflare/cloudflare-docs/issues/new/choose) 

Copy page

# SSH command logs

SSH command logs record the commands that users run on infrastructure targets protected by [Access for Infrastructure](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/). Use these logs to audit user activity on your SSH servers.

To view SSH command logs, log in to [Cloudflare One ↗](https://one.dash.cloudflare.com/) and go to **Insights** \> **Logs** \> **SSH command logs**.

## Prerequisites

To generate SSH command logs, you must:

1. Set up [Access for Infrastructure](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/) for your SSH servers.
2. [Enable SSH command logging](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/#ssh-command-logs) by uploading an encryption public key.

## View SSH logs

SSH command logs displayed in the dashboard are encrypted using a public key you provide. To view the contents of the logs:

1. In [Cloudflare One ↗](https://one.dash.cloudflare.com/), go to **Insights** \> **Logs** \> **SSH command logs**.
2. Filter the logs using the name of your SSH application.
3. Select the SSH session for which you want to export command logs.
4. In the side panel, scroll down to **SSH logs** and select **Download**.
5. Decrypt the log using the [SSH Logging CLI ↗](https://github.com/cloudflare/ssh-log-cli/).

## Explanation of the fields

| Field                       | Description                                                                                  |
| --------------------------- | -------------------------------------------------------------------------------------------- |
| **Session ID**              | Unique identifier for the SSH session.                                                       |
| **User email**              | Email address of the user who initiated the SSH session.                                     |
| **Target ID**               | Identifier of the infrastructure target being accessed.                                      |
| **Client address**          | Source IP address of the SSH connection.                                                     |
| **Server address**          | Destination IP address of the SSH server.                                                    |
| **Session start datetime**  | Timestamp when the SSH session started.                                                      |
| **Session finish datetime** | Timestamp when the SSH session ended.                                                        |
| **Program type**            | Type of SSH program (shell, exec, x11, direct-tcpip, or forwarded-tcpip).                    |
| **Payload**                 | Captured request/response data in asciicast v2 format, including commands for exec programs. |
| **Error**                   | SSH error message, if an error occurred.                                                     |

## Export SSH logs with Logpush

Enterprise users can export SSH command logs using [Logpush](https://developers.cloudflare.com/cloudflare-one/insights/logs/logpush/). Logpush payloads are not encrypted with a customer-provided public key.

For a list of all available fields, refer to [SSH Logs](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/ssh%5Flogs/).

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/cloudflare-one/","name":"Cloudflare One"}},{"@type":"ListItem","position":3,"item":{"@id":"/cloudflare-one/insights/","name":"Insights"}},{"@type":"ListItem","position":4,"item":{"@id":"/cloudflare-one/insights/logs/","name":"Logs"}},{"@type":"ListItem","position":5,"item":{"@id":"/cloudflare-one/insights/logs/dashboard-logs/","name":"Dashboard logs"}},{"@type":"ListItem","position":6,"item":{"@id":"/cloudflare-one/insights/logs/dashboard-logs/ssh-command-logs/","name":"SSH command logs"}}]}
```