[syslog-ng] Syslog-NG Openssh RHEL 4

[Balazs Scheidler]

Hi,

Please check that sshd indeed sends messages to syslog-ng by using
strace. Then if it does please also validate that it is indeed using the
facility/priority values that you are filtering with.

something like this would probably help:

strace -o sshd.trace -s 1024 -f -p <pidofsshd>

make sure that sshd.trace is not user-accessible as it may contain
sensitive information.

you should look for strace entries that contain log messages that you
are interested in.

On Tue, 2009-01-06 at 08:41 -0500, Christopher Bland wrote:
> Hi guys,
> 
> Having a bit of trouble logging sshd messages to my host.  Sshd logs
> fine using syslog but I get nothing using Syslog-NG.  I tried changing
> the SyslogFacility to DAEMON in  sshd_config and still nothing.  I have
> the following lines in my config which should have caught something:
> 
> options {
>     sync (0);
>     time_reopen (10);
>     log_fifo_size (1000);
>     long_hostnames (off);
>     use_dns (no);
>     use_fqdn (no);
>     create_dirs (no);
>     keep_hostname (yes);
> };
> 
> source s_local {
>     file ("/proc/kmsg" log_prefix("kernel: "));
>     unix-dgram("/dev/log");
> #    unix-stream("/dev/log");
>     udp(ip(0.0.0.0) port(514));
>     tcp(ip(0.0.0.0) port(514));
>     internal();
> };
> 
> destination secure { file("/var/log/secure"); };
> destination messages { file("/var/log/messages"); };
> 
> filter f_daemon { facility(daemon); };
> filter f_authpriv { facility(auth, authpriv); };
> 
> log { source(s_local); filter(f_authpriv); destination(secure); };
> log { source(s_local); filter(f_daemon); destination(messages); };
> log { source(s_local);        destination(loghost); };
> 
> My sshd config looks like this:
> Protocol 2
> SyslogFacility AUTHPRIV
> PasswordAuthentication yes
> ChallengeResponseAuthentication no
> GSSAPIAuthentication yes
> GSSAPICleanupCredentials yes
> UsePAM yes
> AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY
> LC_MESSAGES
> AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
> AcceptEnv LC_IDENTIFICATION LC_ALL
> Subsystem    sftp    /usr/libexec/openssh/sftp-server
> 
> Any help is apprciated

-- 
Bazsi