sshd and syslog
 

This is suse 9.0 pro .... w/YOU updates
generic install .... all default.

We have a problem where sshd vanishes in the night. It works when rebooted, but over a day or two the sshd daemon goes away. This is a new (temporary) install for a class with 10-15 people accessing from outside our LAN. The students have an unknown mix of OS/clients. They are using ssh/sftp. All we know is we get a call from someone not able to connect and, sure enough, the daemon is gone. We restart the server ... repeat process.

My question is about capturing exactly when the daemon fails. The messages file (as it defaults) shows nothing of interest .... just pre-failure connections.

I'm looking for suggestions as to if and where messages would/could be generated by the failing daemon.

Would a syslog.conf entry along the lines of "auth.debug /var/log/autherr" possibly capture the act of failing? .... as opposed to only reflecting a deliberate event ...(student connecting, etc)? If I kill it manually there's an entry ... but I'm issuing a local shell command.

Is syslog the way to go here? .... all suggestions welcome.

thanks
fred