Your browser does not allow storing cookies. We recommend enabling them.

Tectia

Configuring Logging in sshd2

sshd2 logs to the facility specified with the configuration option SysLogFacility. If the option is not set, sshd2 logs to the AUTH facility.

For example, if you want sshd2 to log to the LOCAL1 facility, you need to add the following setting to your server's configuration (/opt/tectia/etc/sshd2_config):

SysLogFacility      LOCAL1

The possible facilities are listed in Log Facilities for the SysLogFacility Option.

You also need to modify syslog's configuration, so it knows where to put the log messages.

In /etc/syslog.conf (or equivalent):

local1.info         /var/log/sshd2

On some systems, this file may need to exist before syslog will write to it, so you may need to create it:

# touch /var/log/sshd2

If syslog accesses files with a non-root UID, for example logger, you need to change the ownership of the file to that user.

Remember to restart both sshd2 and syslogd after making changes to their configuration files.

Log Facilities for the SysLogFacility Option

The following log facilities are available:

  • DAEMON

  • USER

  • AUTH

  • LOCAL0

  • LOCAL1

  • LOCAL2

  • LOCAL3

  • LOCAL4

  • LOCAL5

  • LOCAL6

  • LOCAL7


 

 
What to read next:

  • Reduce Secure Shell risk. Get to know the NIST 7966.



    The NISTIR 7966 guideline from the Computer Security Division of NIST is a direct call to action for organizations regardless of industry and is a mandate for the US Federal government.
    Download now
  • ISACA Practitioner Guide for SSH



    With contributions from practitioners, specialists and SSH.COM experts, the ISACA “SSH: Practitioner Considerations” guide is vital best practice from the compliance and audit community.
    Download now