Debian 9 server no sshd in auth.logHang while starting several daemonsSuddenly mysql/mariadb won't startLogstash: Failed to flush outgoing itemsHow do I watch local# to ensure messages are being sent to it?graylog not getting cents 7.1 syslog messages using the rsyslogd serviceSSH login using Active Directory credentialsRsyslog hangs after memory usage 456 MBSystem logs are empty (/var/log/messages; /var/log/secure; etc)Ubuntu 18.04 server - how to change or adjust operating system logging for a certain systemd service?Is rsyslog redundant on when using journald?
How can we delete item permanently without storing in Recycle Bin?
Promotion comes with unexpected 24/7/365 on-call
Do high-wing aircraft represent more difficult engineering challenges than low-wing aircraft?
FIFO data structure in pure C
I recently started my machine learning PhD and I have absolutely no idea what I'm doing
Holding rent money for my friend which amounts to over $10k?
Could a space colony 1g from the sun work?
Is it standard to have the first week's pay indefinitely withheld?
Why is so much ransomware breakable?
How to handle professionally if colleagues has referred his relative and asking to take easy while taking interview
Do we see some Unsullied doing this in S08E05?
Given 0s on Assignments with suspected and dismissed cheating?
Would it be fair to use 1d30 (instead of rolling 2d20 and taking the higher die) for advantage rolls?
Assign the same string to multiple variables
Physically unpleasant work environment
Why didn't Daenerys' advisers suggest assassinating Cersei?
When did Britain learn about American independence?
How do Ctrl+C and Ctrl+V work?
How to generate a triangular grid from a list of points
Why do academics prefer Mac/Linux?
Why would you put your input amplifier in front of your filtering for and ECG signal?
How could it be that 80% of townspeople were farmers during the Edo period in Japan?
Write electromagnetic field tensor in terms of four-vector potential
Is it possible to pass a pointer to an operator as an argument like a pointer to a function?
Debian 9 server no sshd in auth.log
Hang while starting several daemonsSuddenly mysql/mariadb won't startLogstash: Failed to flush outgoing itemsHow do I watch local# to ensure messages are being sent to it?graylog not getting cents 7.1 syslog messages using the rsyslogd serviceSSH login using Active Directory credentialsRsyslog hangs after memory usage 456 MBSystem logs are empty (/var/log/messages; /var/log/secure; etc)Ubuntu 18.04 server - how to change or adjust operating system logging for a certain systemd service?Is rsyslog redundant on when using journald?
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
On one of my servers, Debian 9, there is no output from sshd in /var/log/auth.log. In fact, if I do ag sshd in /var/log, it just doesn't appear. The only thing in auth.log is systemd-logind. In fact, it's suspicous that almost all log messages are from systemd. Only a sporadic few from something else.
This is my /etc/rsyslog.conf (minus comments) (it should be default):
module(load="imuxsock") # provides support for local system logging
module(load="imklog") # provides kernel logging support
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf
auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none -/var/log/syslog
daemon.* -/var/log/daemon.log
kern.* -/var/log/kern.log
lpr.* -/var/log/lpr.log
mail.* -/var/log/mail.log
user.* -/var/log/user.log
mail.info -/var/log/mail.info
mail.warn -/var/log/mail.warn
mail.err /var/log/mail.err
*.=debug;
auth,authpriv.none;
news.none;mail.none -/var/log/debug
*.=info;*.=notice;*.=warn;
auth,authpriv.none;
cron,daemon.none;
mail,news.none -/var/log/messages
*.emerg :omusrmsg:*
There's nothing in /etc/rsyslog.d. I also tried copying the conf from an Ubuntu 18.04 machine, to no avail.
SSH is 7.4p1-10+deb9u6. /etc/ssh/sshd_config is:
# cat sshd_config |grep -v '^#'|sed -e '/^$/d'
Port 22
PermitRootLogin yes
ChallengeResponseAuthentication no
UsePAM yes
X11Forwarding yes
PrintMotd no
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server
Rsyslog is running:
# systemctl status rsyslog
● rsyslog.service - System Logging Service
Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
Active: active (running) since Sun 2019-05-05 15:06:20 CEST; 34s ago
Docs: man:rsyslogd(8)
http://www.rsyslog.com/doc/
Main PID: 3551 (rsyslogd)
Tasks: 4 (limit: 4915)
CGroup: /system.slice/rsyslog.service
└─3551 /usr/sbin/rsyslogd -n
May 05 15:06:20 brick systemd[1]: Starting System Logging Service...
May 05 15:06:20 brick systemd[1]: Started System Logging Service.
I vaguely remember that when this problem started, I did see a very occasional message from sshd in auth.log, but I can't prove that right now.
linux debian systemd rsyslog
asked May 5 at 13:10
HalfgaarHalfgaar
5,54043063
add a comment |
On one of my servers, Debian 9, there is no output from sshd in /var/log/auth.log. In fact, if I do ag sshd in /var/log, it just doesn't appear. The only thing in auth.log is systemd-logind. In fact, it's suspicous that almost all log messages are from systemd. Only a sporadic few from something else.
This is my /etc/rsyslog.conf (minus comments) (it should be default):
module(load="imuxsock") # provides support for local system logging
module(load="imklog") # provides kernel logging support
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf
auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none -/var/log/syslog
daemon.* -/var/log/daemon.log
kern.* -/var/log/kern.log
lpr.* -/var/log/lpr.log
mail.* -/var/log/mail.log
user.* -/var/log/user.log
mail.info -/var/log/mail.info
mail.warn -/var/log/mail.warn
mail.err /var/log/mail.err
*.=debug;
auth,authpriv.none;
news.none;mail.none -/var/log/debug
*.=info;*.=notice;*.=warn;
auth,authpriv.none;
cron,daemon.none;
mail,news.none -/var/log/messages
*.emerg :omusrmsg:*
There's nothing in /etc/rsyslog.d. I also tried copying the conf from an Ubuntu 18.04 machine, to no avail.
SSH is 7.4p1-10+deb9u6. /etc/ssh/sshd_config is:
# cat sshd_config |grep -v '^#'|sed -e '/^$/d'
Port 22
PermitRootLogin yes
ChallengeResponseAuthentication no
UsePAM yes
X11Forwarding yes
PrintMotd no
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server
Rsyslog is running:
# systemctl status rsyslog
● rsyslog.service - System Logging Service
Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
Active: active (running) since Sun 2019-05-05 15:06:20 CEST; 34s ago
Docs: man:rsyslogd(8)
http://www.rsyslog.com/doc/
Main PID: 3551 (rsyslogd)
Tasks: 4 (limit: 4915)
CGroup: /system.slice/rsyslog.service
└─3551 /usr/sbin/rsyslogd -n
May 05 15:06:20 brick systemd[1]: Starting System Logging Service...
May 05 15:06:20 brick systemd[1]: Started System Logging Service.
I vaguely remember that when this problem started, I did see a very occasional message from sshd in auth.log, but I can't prove that right now.
linux debian systemd rsyslog
asked May 5 at 13:10
HalfgaarHalfgaar
5,54043063
add a comment |
On one of my servers, Debian 9, there is no output from sshd in /var/log/auth.log. In fact, if I do ag sshd in /var/log, it just doesn't appear. The only thing in auth.log is systemd-logind. In fact, it's suspicous that almost all log messages are from systemd. Only a sporadic few from something else.
This is my /etc/rsyslog.conf (minus comments) (it should be default):
module(load="imuxsock") # provides support for local system logging
module(load="imklog") # provides kernel logging support
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf
auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none -/var/log/syslog
daemon.* -/var/log/daemon.log
kern.* -/var/log/kern.log
lpr.* -/var/log/lpr.log
mail.* -/var/log/mail.log
user.* -/var/log/user.log
mail.info -/var/log/mail.info
mail.warn -/var/log/mail.warn
mail.err /var/log/mail.err
*.=debug;
auth,authpriv.none;
news.none;mail.none -/var/log/debug
*.=info;*.=notice;*.=warn;
auth,authpriv.none;
cron,daemon.none;
mail,news.none -/var/log/messages
*.emerg :omusrmsg:*
There's nothing in /etc/rsyslog.d. I also tried copying the conf from an Ubuntu 18.04 machine, to no avail.
SSH is 7.4p1-10+deb9u6. /etc/ssh/sshd_config is:
# cat sshd_config |grep -v '^#'|sed -e '/^$/d'
Port 22
PermitRootLogin yes
ChallengeResponseAuthentication no
UsePAM yes
X11Forwarding yes
PrintMotd no
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server
Rsyslog is running:
# systemctl status rsyslog
● rsyslog.service - System Logging Service
Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
Active: active (running) since Sun 2019-05-05 15:06:20 CEST; 34s ago
Docs: man:rsyslogd(8)
http://www.rsyslog.com/doc/
Main PID: 3551 (rsyslogd)
Tasks: 4 (limit: 4915)
CGroup: /system.slice/rsyslog.service
└─3551 /usr/sbin/rsyslogd -n
May 05 15:06:20 brick systemd[1]: Starting System Logging Service...
May 05 15:06:20 brick systemd[1]: Started System Logging Service.
I vaguely remember that when this problem started, I did see a very occasional message from sshd in auth.log, but I can't prove that right now.
linux debian systemd rsyslog
asked May 5 at 13:10
HalfgaarHalfgaar
5,54043063
On one of my servers, Debian 9, there is no output from sshd in /var/log/auth.log. In fact, if I do ag sshd in /var/log, it just doesn't appear. The only thing in auth.log is systemd-logind. In fact, it's suspicous that almost all log messages are from systemd. Only a sporadic few from something else.
This is my /etc/rsyslog.conf (minus comments) (it should be default):
module(load="imuxsock") # provides support for local system logging
module(load="imklog") # provides kernel logging support
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf
auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none -/var/log/syslog
daemon.* -/var/log/daemon.log
kern.* -/var/log/kern.log
lpr.* -/var/log/lpr.log
mail.* -/var/log/mail.log
user.* -/var/log/user.log
mail.info -/var/log/mail.info
mail.warn -/var/log/mail.warn
mail.err /var/log/mail.err
*.=debug;
auth,authpriv.none;
news.none;mail.none -/var/log/debug
*.=info;*.=notice;*.=warn;
auth,authpriv.none;
cron,daemon.none;
mail,news.none -/var/log/messages
*.emerg :omusrmsg:*
There's nothing in /etc/rsyslog.d. I also tried copying the conf from an Ubuntu 18.04 machine, to no avail.
SSH is 7.4p1-10+deb9u6. /etc/ssh/sshd_config is:
# cat sshd_config |grep -v '^#'|sed -e '/^$/d'
Port 22
PermitRootLogin yes
ChallengeResponseAuthentication no
UsePAM yes
X11Forwarding yes
PrintMotd no
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server
Rsyslog is running:
# systemctl status rsyslog
● rsyslog.service - System Logging Service
Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
Active: active (running) since Sun 2019-05-05 15:06:20 CEST; 34s ago
Docs: man:rsyslogd(8)
http://www.rsyslog.com/doc/
Main PID: 3551 (rsyslogd)
Tasks: 4 (limit: 4915)
CGroup: /system.slice/rsyslog.service
└─3551 /usr/sbin/rsyslogd -n
May 05 15:06:20 brick systemd[1]: Starting System Logging Service...
May 05 15:06:20 brick systemd[1]: Started System Logging Service.
I vaguely remember that when this problem started, I did see a very occasional message from sshd in auth.log, but I can't prove that right now.
linux debian systemd rsyslog
linux debian systemd rsyslog
asked May 5 at 13:10
HalfgaarHalfgaar
5,54043063
asked May 5 at 13:10
HalfgaarHalfgaar
5,54043063
asked May 5 at 13:10
HalfgaarHalfgaar
5,54043063
asked May 5 at 13:10
HalfgaarHalfgaar
5,54043063
asked May 5 at 13:10
HalfgaarHalfgaar
5,54043063
5,54043063
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
Apparently, /dev/log was missing, which is created by systemd-journald-dev-log.socket. I had to do systemctl restart systemd-journald.service to fix it.
I can't reboot right now to test if this is permanent, but I'll take it for now.
answered May 5 at 13:36
HalfgaarHalfgaar
5,54043063
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f965946%2fdebian-9-server-no-sshd-in-auth-log%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Apparently, /dev/log was missing, which is created by systemd-journald-dev-log.socket. I had to do systemctl restart systemd-journald.service to fix it.
I can't reboot right now to test if this is permanent, but I'll take it for now.
answered May 5 at 13:36
HalfgaarHalfgaar
5,54043063
add a comment |
Apparently, /dev/log was missing, which is created by systemd-journald-dev-log.socket. I had to do systemctl restart systemd-journald.service to fix it.
I can't reboot right now to test if this is permanent, but I'll take it for now.
answered May 5 at 13:36
HalfgaarHalfgaar
5,54043063
add a comment |
Apparently, /dev/log was missing, which is created by systemd-journald-dev-log.socket. I had to do systemctl restart systemd-journald.service to fix it.
I can't reboot right now to test if this is permanent, but I'll take it for now.
answered May 5 at 13:36
HalfgaarHalfgaar
5,54043063
Apparently, /dev/log was missing, which is created by systemd-journald-dev-log.socket. I had to do systemctl restart systemd-journald.service to fix it.
I can't reboot right now to test if this is permanent, but I'll take it for now.
answered May 5 at 13:36
HalfgaarHalfgaar
5,54043063
edited May 5 at 13:41
answered May 5 at 13:36
HalfgaarHalfgaar
5,54043063
answered May 5 at 13:36
HalfgaarHalfgaar
5,54043063
answered May 5 at 13:36
HalfgaarHalfgaar
5,54043063
5,54043063
add a comment |
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f965946%2fdebian-9-server-no-sshd-in-auth-log%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
