I'm attempting to turn on logging inside OpenSSH running in an Alpine Docker container.

I made sure to install rsyslog and start the daemon with /usr/sbin/rsyslogd.

My sshd logging settings are as follows:

SyslogFacility AUTH

After making the configuration change I kill the sshd process and restart it with /usr/sbin/sshd -f /etc/ssh/sshd_config.

I then ssh into the localhost and exit. I'm assuming that I should be seeing a /var/log/auth.log, but no such file appears.

  • 2
    did you configure the rsyslog to catch these messages? Do you have journald in container? – Jakuje Apr 10 '16 at 8:29
  • I'm brand new to rsyslog and the corresponding logging configuration options for OpenSSH. Based on my research it looks like I just need to add: auth,authpriv.* /var/log/auth.log. Currently this line is in the default configuration authpriv.* /var/log/secure , but that does not trigger any logging. I don't think alpine has a journald package. At least running apk add journald does not work ... – Ole Apr 11 '16 at 15:49
  • 1
    OK - Looks like journald might be baked in because after changing the configuration I now get the /var/log/auth.log generated. – Ole Apr 11 '16 at 16:07
  • I'm having this same issue, what config did you change to get it working? – chrismacp Jun 12 '17 at 11:34
  • It's been a while but I think I just changed authpriv.* /var/log/secure to auth,authpriv.* /var/log/auth.log. – Ole Jun 13 '17 at 14:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.