You should be able to filter messages from
journalctl -u ssh
or (depending on your distribution)
journalctl -u sshd
which will show logs in a
less style format (you can search
/, navigate via PgUp, PgDown etc.).
-e brings you to the end of logs.
-u parameter filters through meta field
_SYSTEMD_UNIT which is (at least on Debian) set to
sshd won't match.
-f follows logs in real-time
-n 100 displays given number of lines (useful with
Alternatively you can use meta-fields filtering:
You can display whole journal record with all meta-fields by exporting to JSON:
journalctl -u ssh -o json-pretty
that would give you something like:
"_PID" : "7373",
"_COMM" : "sshd",
"_EXE" : "/usr/sbin/sshd",
"_SYSTEMD_CGROUP" : "/system.slice/ssh.service",
"_SYSTEMD_UNIT" : "ssh.service",
In case you wonder how to display only kernel messages:
journalctl -k -f