logging - Looking into bash script to log SSH activity -

i'm having suspicious ssh activity, apparently originating computer (osx sierra)... reason trying determine why, , more happening.

i'm looking track ssh calls, following seems work reveal process pid makes call. choose check every 15 seconds (perhaps should lower)

lsof -r 15 -i -a -c ssh 

for process run ps -fp <pid> information program making these ssh requests.

i'd automate (run ps -fp ssh activity found) , log resulting information.

i have no real experience making scripts, if me make possible appreciated.

hmm, not sure if work on mac, may started:

while [[ 1 ]] ; echo "## $(date) ##" ; s_pids=$(lsof -i -a -c ssh | awk  '/ssh/ {print $2}') ; ps -fp ${s_pids} ; sleep 15 ; done 

or, log info:

while [[ 1 ]] ; echo "## $(date) ##" ; s_pids=$(lsof -i -a -c ssh | awk  '/ssh/ {print $2}') ; ps -fp ${s_pids} ; sleep 15 ; done | tee /tmp/ssh.log 

:)
dale