Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have been trying to write a program to execute many commands during one ssh connection.

My current way is (1) create SSH connection; (2) create SSH command tunnel/channel whenever needed; (3) close SSH connection.

As expected, I see only two entries in /var/log/secure, corresponding to the ssh open & close event.

My problem is that there are many entries in /var/log/wtmp, corresponding to the log in & out event.

Could you help to comment on the relationships between these two file, in the context of recording SSH connections?

Any insight is appreciated! Sorry for the trouble if the terminology is not appropriate!

share|improve this question
up vote 1 down vote accepted

Log entries in /var/log/secure track authentication events. An authentication event happens whenever you open an SSH connection. These entries may also appear in /var/log/auth.log, /var/log/syslog, /var/log/daemon.log, /var/log/messages and other text mode log files that may exist depending on the system configuration; different distributions have different defaults in this regard.

When you do something over an existing SSH connection, including opening a tunnel or a slave connection, that does not require any authentication step. Therefore there is no recording of that in /var/log/secure.

Entries in /var/log/wtmp (and utmp) record the creation and destruction of terminals, or the assignment and release of terminals to users. Thus they track interactive sessions only. On some setups, every creation of a terminal by a terminal emulator is recorded there. An SSH connection triggers logging in utmp and wtmp if and only if it creates a terminal (i.e. if you don't pass a command and thus get an interactive shell, or if you run ssh -t).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.