I recently tried setting up the ChrootDirectory property in sshd_config and ran into the ownership problems for chroot targets.

After i have fixed the problem i noticed that syslog-ng had created log entries in auth.log:

Feb 21 18:56:18 raspberry sshd[28194]: fatal: bad ownership or modes for chroot directory "/home/smacktard"

Since i am running arch linux, the main logging facility is the journal system of systemd. However, journalctl -fu sshd did not show these log entries.

So i missed these log entries. If i had seen them, i would have fixed the problem faster. I don't want that to happen again, so i did some research:

I figured out that this happened because the -u option of journalctl filters for systemd units. However, the error is produced and logged by a child process of sshd. That means it has a different PID and therefore is not recognised as the systemd unit sshd.service.

How can i systematically find journal entries of child processes?


I have two throughts.

  1. Try this to see all sshd messages: journalctl _COMM=sshd
  2. sshd is somehow configured to log to syslog-ng, not using the whole systemctl/journalctl thing.

The Arch Linux people say you really shouldn't need to run syslog or syslog-ng after converting to using systemd. Since you've got syslog-ng and systemd/journald on the same machine, do you have a /etc/ssh/sshd_config.pacnew file? I recently upgraded, so I don't have a machine that used to not run systemd but now does, so I can't confirm that sshd_config gets updated during that transition.

  • journalctl -f (without the unit filter) shows the log messages so sshd and its childs log to both syslog-ng and journald. AFAIK, no application can control to which logging facility it wants to log. So if your system has both journald and syslog-ng all logs go to both. To your first point: It works! Thank you. Feb 23 '14 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.