Where are SSH logs stored?

I'm trying to diagnose a remote SFTP client that's having problems connecting to my MBP. I'm able to login to this same system using other Mac clients, but am not successful with the SFTP client function of my Sony camera. Being a camera, it's not big on error messages 8^(.


Have not found any obvious log candidates in /var/log - I guess the world has moved on from /var/log/secure.log and friends.


Advice appreciated

-Danny

MacBook Pro 16″

Posted on Feb 1, 2023 8:56 AM

Reply
8 replies

Feb 1, 2023 1:41 PM in response to d.s.cobb

d.s.cobb wrote:

good pointer, etresoft - where is this stuff documented? developer's portal?

It depends. The developer site does have some WWDC videos about the new unified logging system, but they are mostly from the developer's point of view. They describe how to use the log functions and how to view the output of the app you are developing in the debugger. I don't know if the "log" query tool is documented at all except for the man page.


Generally speaking, this information is made available to developers for running and debugging their own software. None of it is intended for viewing the logs of Apple's software. There is no guarantee that there any relevant messages in the log related to sshd. The Mac is not a server so this is not something that Apple supports at all.


Although I used a smiley face above, I wasn't joking. I'm sure your camera doesn't support any modern protocols. I'm frankly surprised it supports ssh at all. Plain FTP I can understand. Maybe double-check that the camera is really doing what you think. I suspect that it isn't.

Feb 1, 2023 10:05 AM in response to d.s.cobb

d.s.cobb wrote:

I guess the world has moved on from /var/log/secure.log and friends.

Apple devices certainly have. You'll need to learn how to use the new unified logging system via the "log" command and its, ahem, extensive usage. You'll probably also want to install a profile so that your logs aren't purged of any useful information as they normally are.


It would probably be easier to just go to your sshd config and enable every single old, deprecated, and broken security protocol you can think of. That should do the trick. 😄

Feb 1, 2023 4:10 PM in response to etresoft

I suspect you're right. I figured out how to run a stand-alone debug instance of sshd on a different port - I can see the connection coming in and getting handed off to sftp_server, which then exits during protocol initialization.


The camera documentation is frustratingly vague about specifics. Talks about "Secure FTP" and "Certificate Errors" but doesn't specifically mention SFTP, FTPS, or SCP. Forces you to enter a port number, but doesn't suggest a port (21? 22?). I've tried all the combinations.


Next step is just a plain old vanilla FTP server - there are a couple in the App Store. There's also the homebrew route, but the information on the web is not promising about that.


I appreciate the help

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Where are SSH logs stored?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.