up vote 4 down vote favorite
share [g+] share [fb]

I have Ubuntu 9.10 installed with sshd and i can successfully connect to it using login and password. I have configured an RSA key login and now have "Server refused our key" as expected. Ok, now i want to check sshd log in order to figure out a problem. I have examined /etc/ssh/sshd_config and it have

SyslogFacility AUTH
LogLevel INFO

Ok. I'm looking at /var/log/auth.log and... it's empty O_O. Changing Loglevel to VERBOSE helps nothing - auth.log is still empty. Any hints how i can check sshd log?

link|improve this question
100% accept rate
3  
Did you check your syslog configuration? I don't run Ubuntu, but it may redirect the AUTH facility to a different logfile. Maybe /var/log/messages ? – Prof. Moriarty Apr 8 '10 at 10:23
How to check a syslog configuration? Unfortunately, i'm not very good a linux :(. cat /var/log/messages | grep ssh shows nothing :(. – Eye of Hell Apr 8 '10 at 10:28
You are correct. /etc/syslog.conf redirects AUTH to /var/logauth.log. Please write your answer so i can accept it :) – Eye of Hell Apr 8 '10 at 10:31
On my machine: The system logs are set in /etc/rsyslog.conf, which in turn includes /etc/rsyslog.d/* The actual file setting the location of the logs is /etc/rsyslog.d/50-default.conf. – Richard Holloway Apr 8 '10 at 11:53
feedback

1 Answer

up vote 1 down vote accepted

If no one else is using the system at the moment you could do what i've done in such cases:

  • stop sshd service (at least i've been able to do this while logged in via ssh)
  • start sshd manually and add some -d options to get more verbose debug output. Unless you have something funky going on it should use the same keys and config it does when started properly
link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.