Otdfbt

On one of my servers, Debian 9, there is no output from sshd in /var/log/auth.log. In fact, if I do ag sshd in /var/log, it just doesn't appear. The only thing in auth.log is systemd-logind. In fact, it's suspicous that almost all log messages are from systemd. Only a sporadic few from something else.

This is my /etc/rsyslog.conf (minus comments) (it should be default):

module(load="imuxsock") # provides support for local system logging
module(load="imklog") # provides kernel logging support

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022

$WorkDirectory /var/spool/rsyslog

$IncludeConfig /etc/rsyslog.d/*.conf

auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none -/var/log/syslog
daemon.* -/var/log/daemon.log
kern.* -/var/log/kern.log
lpr.* -/var/log/lpr.log
mail.* -/var/log/mail.log
user.* -/var/log/user.log

mail.info -/var/log/mail.info
mail.warn -/var/log/mail.warn
mail.err /var/log/mail.err

*.=debug;
 auth,authpriv.none;
 news.none;mail.none -/var/log/debug
*.=info;*.=notice;*.=warn;
 auth,authpriv.none;
 cron,daemon.none;
 mail,news.none -/var/log/messages

*.emerg :omusrmsg:*

There's nothing in /etc/rsyslog.d. I also tried copying the conf from an Ubuntu 18.04 machine, to no avail.

SSH is 7.4p1-10+deb9u6. /etc/ssh/sshd_config is:

# cat sshd_config |grep -v '^#'|sed -e '/^$/d'
Port 22
PermitRootLogin yes
ChallengeResponseAuthentication no
UsePAM yes
X11Forwarding yes
PrintMotd no
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server

Rsyslog is running:

# systemctl status rsyslog
● rsyslog.service - System Logging Service
 Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
 Active: active (running) since Sun 2019-05-05 15:06:20 CEST; 34s ago
 Docs: man:rsyslogd(8)
 http://www.rsyslog.com/doc/
 Main PID: 3551 (rsyslogd)
 Tasks: 4 (limit: 4915)
 CGroup: /system.slice/rsyslog.service
 └─3551 /usr/sbin/rsyslogd -n

May 05 15:06:20 brick systemd[1]: Starting System Logging Service...
May 05 15:06:20 brick systemd[1]: Started System Logging Service.

I vaguely remember that when this problem started, I did see a very occasional message from sshd in auth.log, but I can't prove that right now.

Apparently, /dev/log was missing, which is created by systemd-journald-dev-log.socket. I had to do systemctl restart systemd-journald.service to fix it.

I can't reboot right now to test if this is permanent, but I'll take it for now.