Trouble with sshd and syslog

Question

Level 2

305 points

Trouble with sshd and syslog

My syslog contains:

auth. ;authpriv.*;remoteauth. /var/log/secure.log

My sshd_config contains:

SyslogFacility AUTHPRIV
LogLevel DEBUG

But when sshd runs, nothing ends up in secure.log. And given that I have a ssh problem that I want to debug, I am kind of lost. How do I find out why I do not get these syslog messages?

Actually, since Jan 21, nothing has been added to secure.log whereas normally I would see ssh logins there, so something has gone awry. But I have no clue what.

500Mhz G4 Cube w Radeon 9000, 120GB Seagate, 1.2GHz G4 iBook, DTK

Posted on Jan 27, 2009 2:50 AM

Reply

Answer 1

Gerben Wierda Author

Level 2

305 points

Jan 27, 2009 2:53 AM in response to Gerben Wierda

The line from syslog reads auth dot star semicolon authpriv dot star semicolon remoteauth dot star

When I type this in a discussion item like this:

auth. ;authpriv.*;remoteauth. /var/log/secure.log

It seems the discussion web site gobbles some characters.

Reply

Answer 2

Gerben Wierda Author

Level 2

305 points

Jan 27, 2009 4:11 AM in response to Gerben Wierda

I have one more clue to what is going wrong:

$ syslog -s -r 192.168.2.66 -k Facility AUTH Level 4 Message 'Hello, World!'
$ syslog -s -k Facility AUTH Level 4 Message 'Hello, World! local'
$ sudo grep Hello /var/log/*log
/var/log/secure.log:Jan 27 13:07:32 192.168.2.66 syslog[0]: Hello, World!

In other words: via the UDP socket, syslog works. But via the local device, it does not.

Reply

Answer 3

Gerben Wierda Author

Level 2

305 points

Jan 27, 2009 4:51 AM in response to Gerben Wierda

Turned out the dgram socket was broken. A repair permissions for the startup volume fixed that.

Reply