Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to go failed (either incorrect username, password, or both) on my server.

I changed /etc/ssh/sshd_config from

# Logging
SyslogFacility AUTH 
LogLevel INFO


# Logging
SyslogFacility AUTH 

and have since tried multiple ssh attempts with both existing and non-exisiting users with random passwords thus failing. When checking /var/log/auth.log nothing appears and it is entirely blank.

What am I missing? Does some other process need to also be install and running on my system? I'm running Ubuntu.

Any help or guidance on this matter is more than welcome.


share|improve this question
Did you restart sshd? – bonsaiviking Dec 3 '12 at 22:26
What does your syslog configuration look like? This would probably be a file at /etc/syslog.conf or /etc/rsyslog.conf or /etc/rsyslog.d/*.conf – Stefan Lasiewski Dec 4 '12 at 0:03
@StefanLasiewski the first 2 are empty and /etc/rsyslog.d/*.conf says "$AddUnixListenSocket /var/spool/postfix/dev/log" – Georgejnr Dec 4 '12 at 0:12
@Georgejnr : If that is the case, it appears that the syslog configuration on your system is broken. There is normally a syslog file under /etc/syslog.conf or /etc/rsyslog.conf , and normally there should be more then one file under /etc/rsyslog.d/*.conf . Does ps aux show a syslog process? – Stefan Lasiewski Dec 4 '12 at 0:33
@StefanLasiewski no it is not listed in ps aux. The previous sysadmin went a little rogue and broke a few things I believe on purpose. Think this could be part of it? How do I go about fixing this issue? – Georgejnr Dec 4 '12 at 0:42

The LogLevel generally (apparently application dependent) refers to one of the defined severity levels supported by the system logging process (syslog). So change it back and restart the sshd server.

Now if you are not getting the output, you need to look at the system /etc/syslog.conf and see what MINIMUM loglevel the AUTH type of requests are being logged and to what file. The errors might be going to a different log file. OR you might not be logging these errors due to the syslog.conf configuration for the AUTH service. For more information consult the man pages on and syslog.conf.

share|improve this answer
From sshd_config(5) LogLevel: Gives the verbosity level that is used when logging messages from sshd(8). The possible values are: QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. – bonsaiviking Dec 3 '12 at 22:28
my /syslog.conf is empty. I must add that I am taking over someone else's system and it seems that they didn't do a very good job of setting it up. Does the lack of syslog.conf mean that I am missing a service? (thanks for your response) – Georgejnr Dec 3 '12 at 22:31
File is in / is possible that you might not be logging anything. – mdpc Dec 3 '12 at 22:33
About VERBOSE in mistake, but its not a syslog log level which is commonly asked for in many of the programs I have dealt with. – mdpc Dec 3 '12 at 22:33
leaving VERBOSE still in my sshd_config and running sudo /etc/init.d/ssh restart it still isn't logging. Am I being dumb about something? – Georgejnr Dec 3 '12 at 22:40

When I had the same problem on Debian, I found I had to restart rsyslogd:

/etc/init.d/rsyslog restart

(Your syslogd program may vary.)

The it started writing to /var/log/auth.log again.

Perhaps it had stopped logging after a disk full event, I'm not sure.

See also:

share|improve this answer

In my case there was no diskspace on left on the root file-system /, which you can check for with df -h

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.