ssh audit function