I've already tried to follow the solutions from Where are my sshd logs?, in particular I have:
changed
/etc/ssh/sshd_config
by settingSyslogFacility
toAUTH
orAUTHPRIV
andLogLevel
toVERBOSE
or evenDEBUG
checked
/etc/rsyslog.conf
, it contains
auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none -/var/log/syslog
restarted sshd by either
service ssh restart
or by/etc/init.d/ssh restart
or even by manually killingsshd
and then restarting itto test the logging I ssh from another machine and give first a wrong password, and next the good one.
to check the logs I've tried all the following:
cat /var/log/auth.log
cat /var/log/debug
cat /var/log/messages
cat /var/log/daemon.log
cat /var/log/syslog
journalctl _SYSTEMD_UNIT=sshd.service
journalctl _COMM=ssh
journalctl _COMM=sshd
journalctl -u ssh
journalctl -u sshd
but there's no message at all from sshd. What else remains to show some log from sshd?
/var/log/syslog
but not listed in the checked list – Gilles Quénot Dec 17 '22 at 11:46grep ssh /var/log/*
– cipper Dec 18 '22 at 07:46-
is intentional in your log conf ?-/var/log/syslog
– Gilles Quénot Dec 18 '22 at 07:48