How to send SSH logs to a text file?

pete.g · 07-14-2020, 12:08 PM

How do I get the debug logs you get when using the "-vvv" switch with the ssh command "ssh -vvv username@remotehost" redirected to a text file rather than the users screen?

It's very distracting for the user to get all that extra output popping up on their screen whenever using ssh.

I'd like this to be totally transparent to the user, and not asking them to do anything different than what they usually do.

I've tried adding the DEBUG line to ssh_config, but it clutters up their screen with log messages - it doesn't pipe anything to a file.

This is using CentOS 7.7.

Thanks

scasey · 07-14-2020, 12:28 PM

From man ssh

Code:

-y      Send log information using the syslog(3) system module.  By default this information is sent to stderr.

This implies that you could redirect STDERR to a file, but you'd need to confirm that.

Are you having the users enter the -vvv? Then you'd need to add the -y

Code:

ssh -yvvv username@remotehost

or the redirect

Code:

ssh -vvv username@remotehost 2> /path/to/somefile

Insure that the user has write permission to the location of somefile.

If you're using a script or an alias to add the debug option, you can just adjust it, of course.

Turbocapitalist · 07-14-2020, 12:31 PM

Or even save directly to the log file without a redirect.

Code:

ssh -E ~/ssh.log -vvv you@remote

Dig around in the manual page, since there will be other options worth knowing about. You won't remmeber all of them but you might remember that they're there and benefit from being able to look them up.

scasey · 07-14-2020, 12:35 PM

Also this from man ssh_config:

Code:

    LogLevel
             Gives the verbosity level that is used when logging messages from ssh(1).  The possible values are: QUIET, FATAL, ERROR, 
             INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3.  The default is INFO.  DEBUG and DEBUG1 are
             equivalent.  DEBUG2 and DEBUG3 each specify higher levels of verbose output.

Don't know if that will suppress the output to the screen, tho.

So, as suggested, dig around in the man pages more.

pete.g · 07-14-2020, 12:37 PM

As I stated I don't want the users to have to do anything on their end - they shouldn't have to add any switches to their command line for this to happen.

I'm assuming this can be configured to happen in a .conf file somewhere.

pete.g · 07-14-2020, 12:39 PM

The LOGLEVEL option in ssh_config sends all messages to the users screen - I don't want it sent to their screen - I want it sent to a log file, without the user having to add any switches to their commandline

scasey · 07-14-2020, 12:43 PM

Quote:

Originally Posted by pete.g

The LOGLEVEL option in ssh_config sends all messages to the users screen - I don't want it sent to their screen - I want it sent to a log file, without the user having to add any switches to their commandline

Study man ssh_config then. If it can be done from the command line, it can probably be done from the config file. Look for something similar to the -E option in man ssh.

pan64 · 07-14-2020, 12:51 PM

you can use an alias for ssh (or users can have their own personal aliases)

TB0ne · 07-14-2020, 12:52 PM

Quote:

Originally Posted by pete.g

As I stated I don't want the users to have to do anything on their end - they shouldn't have to add any switches to their command line for this to happen.

Confused by this; you say you don't want them to have any switches added to their command line...yet say they're starting things with "-vvv"??? You also say it's distracting for the user, but what actual PROBLEM does it cause, and why enable the -vvv to start with, if you don't want/need that diagnostic info? Typically that flag is done to diagnose connectivity problems, not for daily use.

Quote:

I'm assuming this can be configured to happen in a .conf file somewhere.

Not that I can see. However, since you're ALREADY specifying the "-vvv" on the command line, specify something else:

Code:

ssh user@10.11.12.13 -vvv 2>/var/log/username-ssh-info.log

..which will redirect the diagnostic messages to that file. Simple enough to write a bash script 'wrapper' to take a user name and IP address, and run the command line like that for all users.

Turbocapitalist · 07-14-2020, 12:55 PM

Most of the options which you can add at run time can be included in a configuration file for the client. However, -E is not one of them, it appears. See "man ssh_config". You could grab the output using LogLevel and SyslogFacility via the system logs, as mentioned above.

There are user-level client configuration files, defaulting to ~/.ssh/config, and system-wide client configuration files, defaulting to /etc/ssh/ssh_config and /etc/ssh/ssh_config.d/* and the former override the latter if they exist.

Code:

Host *.example.com
       LogLevel DEBUG3
       SyslogFacility LOCAL0

Also the contents of the file should go from specific to general since they configuration options are applied on the first use basis.

scasey · 07-14-2020, 01:15 PM

Quote:

Originally Posted by Turbocapitalist

Most of the options which you can add at run time can be included in a configuration file for the client. However, -E is not one of them, it appears. See "man ssh_config". You could grab the output using LogLevel and SyslogFacility via the system logs, as mentioned above.

There are user-level client configuration files, defaulting to ~/.ssh/config, and system-wide client configuration files, defaulting to /etc/ssh/ssh_config and /etc/ssh/ssh_config.d/* and the former override the latter if they exist.

Code:

Host *.example.com
       LogLevel DEBUG3
       SyslogFacility LOCAL0

Also the contents of the file should go from specific to general since they configuration options are applied on the first use basis.

That worked for me, except I don't know where the log file ended up.
I put that in the user's ~/.ssh/ssh_config (not ~/.ssh/config on my CentOS 7 box) Hmm. the man page does say .ssh/config, but .ssh/ssh_config seems to work.

Edit: Hmm. I don't find a SysLogFacility option in the ssh_config man page here...I'm not finding anything to specify a log file for the ssh client - except the -E command line option.

michaelk · 07-14-2020, 01:20 PM

That would be as defined in your /etc/rsyslog.conf

local7.* /var/log/boot.log

TB0ne · 07-14-2020, 01:28 PM

Quote:

Originally Posted by Turbocapitalist

Most of the options which you can add at run time can be included in a configuration file for the client. However, -E is not one of them, it appears. See "man ssh_config". You could grab the output using LogLevel and SyslogFacility via the system logs, as mentioned above.

There are user-level client configuration files, defaulting to ~/.ssh/config, and system-wide client configuration files, defaulting to /etc/ssh/ssh_config and /etc/ssh/ssh_config.d/* and the former override the latter if they exist.

Code:

Host *.example.com
       LogLevel DEBUG3
       SyslogFacility LOCAL0

Also the contents of the file should go from specific to general since they configuration options are applied on the first use basis.

Nice one.

scasey · 07-14-2020, 01:33 PM

Quote:

Originally Posted by michaelk

That would be as defined in your /etc/rsyslog.conf

local7.* /var/log/boot.log

Aha. Learn something every day! Thanks! No local0 there, but I suppose one could be added to log ssh stuff...or some other rule.
I'll leave that to the OP to figure out.

Another idea that comes to mind is to alias ssh to include the -E option...oh...already suggested by pan64.

All in all an interesting problem...and I think the solution is here. pete.g, please let us know which idea worked out for you.

pete.g · 07-14-2020, 02:45 PM

Quote:

Originally Posted by Turbocapitalist

Most of the options which you can add at run time can be included in a configuration file for the client. However, -E is not one of them, it appears. See "man ssh_config". You could grab the output using LogLevel and SyslogFacility via the system logs, as mentioned above.

There are user-level client configuration files, defaulting to ~/.ssh/config, and system-wide client configuration files, defaulting to /etc/ssh/ssh_config and /etc/ssh/ssh_config.d/* and the former override the latter if they exist.

Code:

Host *.example.com
       LogLevel DEBUG3
       SyslogFacility LOCAL0

Also the contents of the file should go from specific to general since they configuration options are applied on the first use basis.

------------
That was along the lines of what I was looking for, but it's not quite working yet:

When I try to ssh anywhere after adding this snippet to /etc/ssh/ssh_config, I get an error "Bad configuration option: syslogfacility"
If I add it to .ssh/config, I get an error "bad owner or permissions on /home/user/.ssh/config" even if I make the permissions 777
I added a line to /etc/rsyslog.conf "local0.* /var/log/ssh.log".
For testing purposes I made that log with 777 permissions too.