topic Re: syslogd: sshd not logging to separate file in Operating System - HP-UX

syslogd: sshd not logging to separate file

Ralph Grothe — Thu, 09 Dec 2004 12:13:25 GMT

Hi,

what the hack is wrong with this config?

# grep -v ^# /etc/syslog.conf
mail.debug /var/adm/syslog/mail.log
local6.debug /var/adm/syslog/sshd.log
*.info;local6,mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *

# grep -E '^Syslog|LogLevel' /opt/ssh/etc/sshd_config
SyslogFacility LOCAL6
LogLevel INFO

# /sbin/init.d/secsh start
HP-UX Secure Shell started

# ps -fp $(cat /var/run/sshd.pid)
UID PID PPID C STIME TTY TIME COMMAND
root 29239 1 0 18:06:47 ? 0:01 /opt/ssh/sbin/sshd -f /opt/ssh/etc/sshd_config

# ps -fp $(cat /var/run/syslog.pid)
UID PID PPID C STIME TTY TIME COMMAND
root 502 1 0 Dec 7 ? 0:00 /usr/sbin/syslogd -D

# kill -HUP $(cat /var/run/syslog.pid) && tail -1 /var/adm/syslog/syslog.log
Dec 9 18:11:02 jupiter syslogd: restart

But there is no separate sshd.log

# ll /var/adm/syslog/{syslog,sshd}.log
/var/adm/syslog/sshd.log not found
-rw-r--r-- 1 root root 288294 Dec 9 18:12 /var/adm/syslog/syslog.log

Re: syslogd: sshd not logging to separate file

Fred Ruffet — Thu, 09 Dec 2004 12:20:20 GMT

you ask for info6.debug to log into this particular file. info6.info is logged to syslog.log.

To log ssh to this particular file, you should have this line in /etc/syslog.conf :
local6.info /var/adm/syslog/sshd.log
then restart syslod with "kill -1"

Regards,

Fred

Re: syslogd: sshd not logging to separate file

Sanjay_6 — Thu, 09 Dec 2004 12:21:20 GMT

hi,

Try this in your /etc/syslog.conf file,

local6.info /var/adm/syslog/sshd.log

restart syslogd.

Hope this helps.

regds

Re: syslogd: sshd not logging to separate file

RAC_1 — Thu, 09 Dec 2004 12:25:09 GMT

You need as follows.

local6.info /var/adm/syslog/sshd.log
Restart syslod after changes are made.

Anil

Re: syslogd: sshd not logging to separate file

Ralph Grothe — Thu, 09 Dec 2004 12:37:25 GMT

Hm, I thought level debug were lowest priority so that every utter should be logged.

I changed from debug to info.
I also tried with the sshd.log line above and below the facility "none" line.
It didn't work either way.

[root@jupiter:/etc]
# cat /etc/syslog.conf
# @(#) $Revision: 74.1 $
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
*.info;local6,mail.none /var/adm/syslog/syslog.log
local6.info /var/adm/syslog/sshd.log
*.alert /dev/console
*.alert root
*.emerg *
[root@jupiter:/etc]
# kill -HUP $(cat /var/run/syslog.pid) && tail -1 /var/adm/syslog/syslog.log
Dec 9 18:33:38 jupiter syslogd: restart
[root@jupiter:/etc]
# ll /var/adm/syslog/sshd.log
/var/adm/syslog/sshd.log not found

Re: syslogd: sshd not logging to separate file

Geoff Wild — Thu, 09 Dec 2004 12:38:55 GMT

Do you have a "tab" between local6.info and /var/adm/syslog/sshd.log?

Rgds...Geoff

Re: syslogd: sshd not logging to separate file

Fred Ruffet — Thu, 09 Dec 2004 12:42:14 GMT

sshd.log will only be created when needed for the first entry to put. Not at syslogd start.

Connect a new ssh session. Then file will be there.

Regards,

Fred

Re: syslogd: sshd not logging to separate file

Paul F. Carlson — Thu, 09 Dec 2004 12:49:11 GMT

Try removing the local6 from the following line, that should work.

*.info;local6,mail.none /var/adm/syslog/syslog.log

should look like:

*.info;mail.none /var/adm/syslog/syslog.log

Re: syslogd: sshd not logging to separate file

Ralph Grothe — Thu, 09 Dec 2004 12:51:51 GMT

Of course did I connect with ssh to the box right after reinitialization of syslogd.

Even this doesn't appear

[root@jupiter:/var/adm/syslog]
# logger -t HELP -p local6.info "a useless test string"
[root@jupiter:/var/adm/syslog]
# grep HELP syslog.log
[root@jupiter:/var/adm/syslog]
# ll -rt
total 70822
-rw-r--r-- 1 root root 7582739 Apr 5 2002 OLDsyslog.log.gz
-rw-r--r-- 1 root sys 3587637 Mar 30 2004 syslog.log_20030901-20040301.gz
-r--r--r-- 1 root root 2858664 Jul 1 01:58 syslog.log.6
-rw-r--r-- 1 root root 2657657 Aug 1 01:58 syslog.log.5
-r--r--r-- 1 root root 2688924 Sep 1 01:58 syslog.log.4
-r--r--r-- 1 root root 865999 Oct 1 02:00 syslog.log.3
-rw-r--r-- 1 root root 129790 Nov 1 01:59 syslog.log.2
-rw-r--r-- 1 root sys 4126357 Nov 29 11:24 syslog.log_till_200411291124.gz
-rw-r--r-- 1 root root 146258 Dec 1 01:58 syslog.log.1
-r--r--r-- 1 root root 618878 Dec 7 21:48 OLDsyslog.log
-r--r--r-- 1 root root 10368478 Dec 9 09:15 mail.log
-rw-r--r-- 1 root root 290716 Dec 9 18:50 syslog.log

Re: syslogd: sshd not logging to separate file

Geoff Wild — Thu, 09 Dec 2004 12:53:55 GMT

Fred, actually - a restart of syslogd will create all log files required - if they don't exist.

I know, just did it with:

# @(#)B.11.11_LR
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
daemon.info;mail.none /var/adm/syslog/daemon.log
#local5.info;mail.none /var/adm/syslog/ftpd.log
*.info;mail.none,daemon.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *

Didn't have a daemon.log file - and upon restart of syslogd, the file was created with 0 bytes.

Rgds...Geoff

Re: syslogd: sshd not logging to separate file

RAC_1 — Thu, 09 Dec 2004 12:56:01 GMT

Try with follows.

local3.info /var/adm/syslog/sshd.log

There is a "TAB" between columns.

Re: syslogd: sshd not logging to separate file

Ralph Grothe — Thu, 09 Dec 2004 12:58:22 GMT

Eh, horizontal tab was 0x09 and should appear as ^I or \t wasn't it?

# xd -c /etc/syslog.conf
0000000 # @ ( # ) $ R e v i s i o n
0000010 : 7 4 . 1 $ \n # \n # s y s
0000020 l o g d c o n f i g u r a t i
0000030 o n f i l e . \n # \n # S e e
0000040 s y s l o g d ( 1 M ) f o r
0000050 i n f o r m a t i o n a b o
0000060 u t t h e f o r m a t o f
0000070 t h i s f i l e . \n # \n m a
0000080 i l . d e b u g \t \t / v a r / a
0000090 d m / s y s l o g / m a i l . l
00000a0 o g \n * . i n f o ; l o c a l 6
00000b0 , m a i l . n o n e \t / v a r /
00000c0 a d m / s y s l o g / s y s l o
00000d0 g . l o g \n l o c a l 6 . i n f
00000e0 o / v
00000f0 a r / a d m / s y s l o g / s s
0000100 h d . l o g \n * . a l e r t \t \t
0000110 \t / d e v / c o n s o l e \n * .
0000120 a l e r t \t \t \t r o o t \n * . e
0000130 m e r g \t \t \t * \n
0000139

Re: syslogd: sshd not logging to separate file

Fred Ruffet — Thu, 09 Dec 2004 13:03:30 GMT

looking at man syslod you were right to say setting debug level to this file will send info level message to it too.

Have you tried with sshd_config defaults (AUTH.INFO) ?

Regards,

Fred

Re: syslogd: sshd not logging to separate file

Ralph Grothe — Thu, 09 Dec 2004 13:05:12 GMT

Guys, I'm getting mad,
this has been a too long day.

On the failover node saturn I have it configured (almost) alike, and it works there.

[root@saturn:/root]
# cat /etc/syslog.conf
# @(#) $Revision: 1.2 $
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
*.info;daemon,mail.none /var/adm/syslog/syslog.log
daemon.debug /var/adm/syslog/daemon.log
local6.debug /var/adm/syslog/sshd.log
local7.debug /var/adm/syslog/sshd_p7777.log
*.alert /dev/console
*.alert root
*.emerg *

[root@saturn:/root]
# logger -t TESTME -p local6.info Hello\ World

[root@saturn:/root]
# tail -1 /var/adm/syslog/sshd.log
Dec 9 19:02:09 saturn TESTME: Hello World

Re: syslogd: sshd not logging to separate file

Ralph Grothe — Thu, 09 Dec 2004 13:08:30 GMT

Fred,

at least on saturn this isn't necessary,
it works well with LOCAL6 (this is also in accordance with what sshd_config's manpage reads)

[root@saturn:/root]
# grep -E ^Syslog\|LogLevel /opt/ssh/etc/sshd_config
SyslogFacility LOCAL6
LogLevel INFO

Re: syslogd: sshd not logging to separate file

Fred Ruffet — Thu, 09 Dec 2004 13:08:53 GMT

One thing I see is on jupiter, you have local6.none for syslog.log. It should be OK, but as long as they act different, try to remove local6 from syslog.log line.

Regards,

Fred

Re: syslogd: sshd not logging to separate file

Ralph Grothe — Thu, 09 Dec 2004 13:13:37 GMT

Oops, already past 7.
I have to leave,
will be fumbling on tomorrow.
If I can't sort it out, I'll simply take the working config from saturn...

Re: syslogd: sshd not logging to separate file

Geoff Wild — Thu, 09 Dec 2004 13:14:17 GMT

Okay - which ssh are you using? HP Secure Shell?

I tried local6 and local7 - still ssh is logged to syslog....

Rgds..Geoff

Re: syslogd: sshd not logging to separate file

Geoff Wild — Thu, 09 Dec 2004 13:20:31 GMT

Okay - got it to work - forgot to change logging in sshd_config

SyslogFacility LOCAL6
LogLevel INFO

# @(#)B.11.11_LR
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
daemon.info;mail.none /var/adm/syslog/daemon.log
local6.debug /var/adm/syslog/sshd.log
#local5.info;mail.none /var/adm/syslog/ftpd.log
*.info;mail.none,daemon.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *

Logging now works to ssh.log

Rgds...Geoff

Re: syslogd: sshd not logging to separate file

Geoff Wild — Thu, 09 Dec 2004 13:23:48 GMT

I still think there is no TAB in your syslog.conf:

l o c a l 6 . i n f
00000e0 o / v
00000f0 a r / a d m / s y s l o g / s s
0000100 h d . l o g \n

Should be

l o c a l 6 . i n f
00000e0 o \t / v
00000f0 a r / a d m / s y s l o g / s s
0000100 h d . l o g \n

Rgds...Geoff