sshd2_config logging: use which facility?

[Lonny Balderston]

Greetings,

I wish to point my sshd logging to a file other than the system log. I think I understand how to do this, but do not know which logging facility to use; I do not want to interfere with the OS in any way.

Current config:
# grep SyslogFacility /etc/ssh2/sshd2_config
# SyslogFacility AUTH
# SyslogFacility LOCAL7
commented out....

# cat /etc/syslog.conf
# @(#) $Revision: 74.1 $
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
*.info;mail.none;local5.none /var/adm/syslog/syslog.log
local5.info;mail.none /var/adm/syslog/ftp.log
*.alert /dev/console
*.alert root
*.emerg *
# 20060511 added for sshd2 message routing; LB:
[which facility?].debug;mail.none /var/adm/syslog/sshd2.log

Thank you.

[Ivan Ferreira · Accepted solution]

Uncomment

SyslogFacility LOCAL7

Restart sshd.

Configure /etc/syslog.conf:

local7.debug;mail.none /var/adm/syslog/sshd2.log

Send HUP signal to the syslogd daemon.

[Ivan Ferreira]

In fact, mail.none is not needed, just configure:

local7.debug /var/adm/syslog/sshd2.log

BTW, I just tested, it works.

[Darrel Louis]

Hi,

If sshd is de only service/app using local7
you can use the following:

local7.* /var/adm/syslog/sshd2.log

Don't forget to use the tab!

Goodluck

Darrel

[Lonny Balderston]

> If sshd is de only service/app using local7

Precisely; how do I tell if local7 (or any other service/app) is in use?

Thanks. Points pending for all.

[Ivan Ferreira]

Is not easy to say. I think that the only way is to know if the configuration file for other serivice is pointing to local7 or if you see messages for other services in the sshd2.log file.

[Darrel Louis]

Hi Lonny,

I always check the log-file, what's being logged and then try to create a standard syslogd.conf file which will be spread to all the servers to create a standard.
But that needs time to investigate.

Darrel

[RAC_1]

As you increase the logging level, you would get logs file with more and more details. And yes log files will grow fast. I would set it to 3. In case you have problem you can always increase the log level and analyze the messages.

[Lonny Balderston]

Thank you all!

For those attempting "Redirect sshd2 messages, not to syslog" using this post:
- point ssh's SyslogFacility to local7 in /etc/ssh2/sshd2_config
- add to /etc/syslog.conf "local7.debug[tab]/var/adm/syslog/sshd2.log" and modify your syslog.log line to omit local7 "*.info;mail.none;local5.none;local7.none[tab]/var/adm/syslog/syslog.log"
- restart ssh (from GSP and after hours, dumps ssh sessions)
- restart syslogd
- check syslog/sshd2log for operation
= and that's it!

[Bill Hassell]

There is no way to know whether a particular program uses one of the local# facilities. There are two ways to see this:

1. Add the local7 facility to syslog.conf then check it to see if anything else shows up...

2. Restart syslogd with the -v option. From now on, there will be two additional numbers in syslog which will show the facility and priority values in syslog files:

From man 3c syslog


Priority

0 = EMERG
1 = ALERT
2 = CRIT
3 = ERR
4 = WARNING
5 = NOTICE
6 = INFO
7 = DEBUG

Facility

A = KERN
B = USER
C = MAIL
D = DAEMON
E = AUTH
F = SYSLOG
G = LPR
H = NEWS
I = UUCP
J = CRON
Q = LOCAL0
R = LOCAL1
S = LOCAL2
T = LOCAL3
U = LOCAL4
V = LOCAL5
W = LOCAL6
X = LOCAL7

NOTE: syslog.conf is processed one line at a time. Unless specifically excluded, LOCAL7 will be logged in the normal syslog.log file as well as the sshd2.log file.