I recently tried setting up the
ChrootDirectory property in
sshd_config and ran into the ownership problems for chroot targets.
After i have fixed the problem i noticed that
syslog-ng had created log entries in
Feb 21 18:56:18 raspberry sshd: fatal: bad ownership or modes for chroot directory "/home/smacktard"
Since i am running arch linux, the main logging facility is the journal system of
journalctl -fu sshd did not show these log entries.
So i missed these log entries. If i had seen them, i would have fixed the problem faster. I don't want that to happen again, so i did some research:
I figured out that this happened because the
-u option of
journalctl filters for systemd units. However, the error is produced and logged by a child process of
sshd. That means it has a different PID and therefore is not recognised as the systemd unit
How can i systematically find journal entries of child processes?