look in your sshd_config file and examine the lines:
SyslogFacility
LogLevel
these variables where the logging info from sshd goes. in the
default sshd_config from openssh, they are set like so:
SyslogFacility AUTH
LogLevel INFO
now, look in your /etc/syslog.conf file to see where auth.info (or
whatever SyslogFacility/LogLevel combination you have chosen in
sshd_config) messages are going to. Typically in Solaris you would
find a line for auth.notice . since sshd logs at the info level (one
level lower than "notice") these messages would not get logged to
/var/log/authlog.
it is handy to examine syslog.conf(4) while you are doing this.
remember to never use any blanks in a syslog.conf line, due to m4(1)
processing by syslogd(1M). if you really want these messages to go to
/var/adm/messages instead of /var/log/authlog, you would do something
like this in /etc/syslog.conf:
auth.info /var/adm/messages
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
these are TABS!
don't forget to HUP syslogd after changing syslog.conf so the changes
take effect, and if you change info in sshd_conf while sshd is
running, you'll have to HUP that too.
hope this helps!
chris
On Thu, May 24, 2001 at 01:33:57PM -0500, [EMAIL PROTECTED] wrote:
> I have been testing the OpenSSH_2.9p1 on Solaris 8 and have been unable to
> get it to log to /var/log/syslog or /var/adm/messages.
> Has anyone else had this issue? Does anyone know how to fix this? It only
> seems to write to the lastlog.
>
> Best regards,
>
> Marc Jacquard
--
Christopher Linn, <[EMAIL PROTECTED]> | By no means shall either the CEC
Staff System Administrator | or MTU be held in any way liable
Center for Experimental Computation | for any opinions or conjecture I
Michigan Technological University | hold to or imply to hold herein.
