2

I'm attempting to turn on logging inside OpenSSH running in an Alpine Docker container.

I made sure to install rsyslog and start the daemon with /usr/sbin/rsyslogd.

My sshd logging settings are as follows:

SyslogFacility AUTH LogLevel VERBOSE

After making the configuration change I kill the sshd process and restart it with /usr/sbin/sshd -f /etc/ssh/sshd_config.

I then ssh into the localhost and exit. I'm assuming that I should be seeing a /var/log/auth.log, but no such file appears.

Improve this question
6
  • 2
    did you configure the rsyslog to catch these messages? Do you have journald in container? Commented Apr 10, 2016 at 8:29
  • I'm brand new to rsyslog and the corresponding logging configuration options for OpenSSH. Based on my research it looks like I just need to add: auth,authpriv.* /var/log/auth.log. Currently this line is in the default configuration authpriv.* /var/log/secure , but that does not trigger any logging. I don't think alpine has a journald package. At least running apk add journald does not work ... Commented Apr 11, 2016 at 15:49
  • 1
    OK - Looks like journald might be baked in because after changing the configuration I now get the /var/log/auth.log generated. Commented Apr 11, 2016 at 16:07
  • I'm having this same issue, what config did you change to get it working? Commented Jun 12, 2017 at 11:34
  • It's been a while but I think I just changed authpriv.* /var/log/secure to auth,authpriv.* /var/log/auth.log. Commented Jun 13, 2017 at 14:46

0

Reset to default

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.