1

I've already tried to follow the solutions from Where are my sshd logs?, in particular I have:

  • changed /etc/ssh/sshd_config by setting SyslogFacility to AUTH or AUTHPRIV and LogLevel to VERBOSE or even DEBUG

  • checked /etc/rsyslog.conf, it contains

auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
  • restarted sshd by either service ssh restart or by /etc/init.d/ssh restart or even by manually killing sshd and then restarting it

  • to test the logging I ssh from another machine and give first a wrong password, and next the good one.

  • to check the logs I've tried all the following:

cat /var/log/auth.log
cat /var/log/debug
cat /var/log/messages
cat /var/log/daemon.log
cat /var/log/syslog
journalctl _SYSTEMD_UNIT=sshd.service
journalctl _COMM=ssh
journalctl _COMM=sshd
journalctl -u ssh
journalctl -u sshd

but there's no message at all from sshd. What else remains to show some log from sshd?

cipper
  • 363
  • 2
  • 11

0 Answers0