Can't find my sshd log file...

mantonr · 08-11-2008, 06:14 AM

I can't find my log file anywhere, I've looked in the normal places and tried using slocate to find it but can't find it anywhere. Does anyone know what has happened, is it possible that I just don't have one?

indeliblestamp · 08-11-2008, 07:30 AM

I get my ssh connection attempts in /var/log/messages. Did you try grepping for 'sshd' there?

chort · 08-11-2008, 08:48 AM

Post the contents of /etc/syslog.conf .

Have you tried looking at /var/log/authlog ?

mantonr · 08-11-2008, 09:08 AM

Brilliant, thank you - the sshd log is in there.

Do you know how I can delete some of the log, get rid of the bits from a long time ago? Is there some kind of command that can do that or do I just have to sit and delete everything up to the date that I want to keep?

Thanks for the help

indeliblestamp · 08-11-2008, 09:35 AM

If you turn logrotate on, it will automatically and periodically rename all your log files to logfilename.1, logfilename.2, etc. Mine does this weekly, and goes up to 4 (So after a month, the 4th one is bumped off). If you tweak the values, you can get rid of logs older than whatever date you want.
P.S. Remember to add logrotate to your cron jobs so it runs periodically by itself.

junpa · 08-11-2008, 09:41 AM

afaik logrotation should be on by default.....

noticed you may be using gentoo, if that is the case you need to install logrotate:

Code:

emerge -av logrotate