Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have Ubuntu 9.10 installed with sshd and i can successfully connect to it using login and password. I have configured an RSA key login and now have "Server refused our key" as expected. Ok, now i want to check sshd log in order to figure out a problem. I have examined /etc/ssh/sshd_config and it have

SyslogFacility AUTH
LogLevel INFO

Ok. I'm looking at /var/log/auth.log and... it's empty O_O. Changing Loglevel to VERBOSE helps nothing - auth.log is still empty. Any hints how i can check sshd log?

share|improve this question
4  
Did you check your syslog configuration? I don't run Ubuntu, but it may redirect the AUTH facility to a different logfile. Maybe /var/log/messages ? –  Prof. Moriarty Apr 8 '10 at 10:23
    
How to check a syslog configuration? Unfortunately, i'm not very good a linux :(. cat /var/log/messages | grep ssh shows nothing :(. –  Eye of Hell Apr 8 '10 at 10:28
    
You are correct. /etc/syslog.conf redirects AUTH to /var/logauth.log. Please write your answer so i can accept it :) –  Eye of Hell Apr 8 '10 at 10:31
    
On my machine: The system logs are set in /etc/rsyslog.conf, which in turn includes /etc/rsyslog.d/* The actual file setting the location of the logs is /etc/rsyslog.d/50-default.conf. –  Richard Holloway Apr 8 '10 at 11:53
    
On my servers, sshd logs to /var/log/secure. This is configured in /etc/rsyslog.conf, on the line beginning "authpriv.*" –  Isaac Betesh Jun 20 '13 at 14:34

2 Answers 2

up vote 1 down vote accepted

If no one else is using the system at the moment you could do what i've done in such cases:

  • stop sshd service (at least i've been able to do this while logged in via ssh)
  • start sshd manually and add some -d options to get more verbose debug output. Unless you have something funky going on it should use the same keys and config it does when started properly
share|improve this answer
13  
Stopping SSHD on a remote server is a really bad idea. This may solve the problem for some (or most) setups most of the time, but if ANYTHING goes wrong - your connection, power on either end, forgetfulness, etc - you're locked out of the box. Which is bad news. –  Sudowned Nov 21 '12 at 18:58

Creating an answer based on the comments above, credit to @Prof. Moriarty and @Eye of Hell

SSH auth failures are logged here /var/log/auth.log

The following should give you only ssh related log lines

grep 'sshd' /var/log/auth.log

To be on the safe side, get the last few hundred lines and then search (because if the log file is too large, grep on the whole file would consume more system resources, not to mention will take longer to run)

tail -500 /var/log/auth.log | grep 'sshd'

share|improve this answer
    
Thanks for the edit. That was an error on my part, should've been tail in the first place (not less). Like I say in the text - "get the last few hundred lines and then search" –  Ram Sep 13 '13 at 18:32
    
This answer. Other answer with green arrow is bogus. Change arrow. –  Achmed Durangi Aug 4 at 23:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.