I just installed Debian 6 on my server and noticed that sshd isn't writing any log to /var/log. I understand this is a huge security issue as I won't be able to know who logged in to my server. Is there anyway to fix this?


By default, sshd's SyslogFacility is set to AUTH.

If you haven't changed this in /etc/ssh/sshd_config, you should be getting sshd log information in /var/log/auth.log. You'll also see messages here from pam and sudo, so all access information is logged in the same place.

| improve this answer | |
  • Looks good in sshd_config: # Logging SyslogFacility AUTH LogLevel INFO /var/log/auth.log doesn't exist. – David Dec 30 '11 at 16:37
  • 3
    Odd. All auth messages go there by default. You could check /etc/rsyslog.conf to confirm that it hasn't been directed elsewhere. Are your other logs being updated correctly? Is rsyslogd running? – eaj Dec 30 '11 at 16:45
  • Thank you so much! Yep you're right, for some reason rsyslogd isn't even installed. I installed rsyslogd and the ssh access log is in auth.log like you said. Is there a way to install all of essential packages? I had to install nano and tcpdump as it isn't included in my version of Debian. I think the version of Debian I have is the bare minimum. – David Dec 30 '11 at 17:05
  • I haven't gone through the installation recently, but I'd expect any default configuration to include rsyslogd. Unless it's really bare-bones, I'd just install things as you need them. Pretty soon you'll find it's all there. – eaj Dec 30 '11 at 17:16
  • I am tailing every file in /var/log and all I am getting is: Feb 15 07:21:40 zmijevik sshd[8764]: Connection closed by [preauth], why is it not logging failed connections? – Joseph Persie Feb 15 '16 at 12:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.