0

Most of the time ssh [email protected] works fine, but sometimes I get this error message:

ssh_exchange_identification: Connection closed by remote host
  1. Is there a log with all these errors in which I can see how many times this happens?
  2. If this happens through ssh, does this mean it might also sporadically happen on web-requests to the Apache that is installed on this server?
  3. What can cause this / how can I debug

1 Answer 1

1

The basic debugging step is to check the trace and the logs.

You get a trace of what SSH does by adding the -v option to the ssh command. Repeating the option gives you more logs. Most network- and authentication-related issues require -vv.

ssh -vv [email protected]

“Connection closed by remote host” is a somewhat generic message: it means that the remote host closed the connection at some point instead of sending a reply to a packet. The cause could be completely different depending on exactly when this happens. The trace will at least indicate the time, if not the cause.

There are more logs on the server side. These require administrator permissions to view (they may contain security-sensitive information). The logs are generally stored in /var/log, but this depends on the distribution, on the system configuration and on the choice of logging software.

Since this is an intermittent error, the most likely error is that some system component is running out of resources (memory, file descriptors, terminals, …). It could also be a network relay on the way that's dropping the connection, or that's dropping or corrupting packets. Depending on the cause, this may or may not risk affecting Apache as well.

4
  • Which logs are relevant under /var/log?
    – Noam
    Jan 21, 2015 at 14:55
  • @Noam Depends on the distribution and configuration. Could be auth.log. The easiest way to find the right log is to make an attempt and check which files in /var/log were modified during that attempt. Jan 21, 2015 at 15:29
  • The last file that was changed seems like btmp, but it's a binary file. Makes sense?
    – Noam
    Jan 21, 2015 at 15:53
  • @Noam btmp records login sessions. If it changes, I think that means that you were successfully authenticated, then something happened. You won't find any clues as to why in that file though. Jan 21, 2015 at 16:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .