I have an application (Nessus) which spawns multiple SSH sessions as it scans and detects compliance issues.

After a some patching this week I started having issues and I am fairly certain I have narrowed it down to the SSH client.

I know I can turn on debug in the config of the OpenSSH client, but it seems as if that will only drop it to the screen. A redirect won't work as the SSH sessions are generated through Nessus.

I am looking to have ALL the SSH client session logging debug level to a file, not just the ones I am initiating logging in.

Thoughts?

We log ours using syslog. First we turn on daemon logging with xinetd

Next we create entry in /etc/syslog.conf to log to a specific file by adding the following line.

It should catch all ssh sessions. If that doesn't work look to see what level Nessus is running at or on and modify /etc/syslog.conf to reflect it.

For examplel openLDAP runs on local4 so we added -

local4.* /var/log/ldap