How does OpenSSH LogLevel option work?

Question

I have the following network topology:

workstation <-> network_device <-> authentication_server

When I log in to network_device from workstation over SSH, then network_device checks with TACACS+ authentication_server if I have a permission to log in, what are my access rights for that network_device, etc. When I execute ssh -o LogLevel=quiet network_device in workstation, then I do not see the network device banner, but I do see the following prompt:

$ ssh -o LogLevel=quiet network_device
TACACS authentication!

Password: 

$ 

This TACACS authentication! string is set by authentication_server. When I execute ssh -vvv -o LogLevel=quiet network_device, then I see that this banner and password prompt seem to have different message IDs. Banner:

debug3: receive packet: type 53                    
debug3: input_userauth_banner                      

*************************************************  
*    Access limited to Authorized Users only    *  
*************************************************  

Password prompt:

debug3: receive packet: type 60                        
debug2: input_userauth_info_req                        
debug2: input_userauth_info_req: num_prompts 1         
TACACS authentication!                           

Password:    

Does OpenSSH client LogLevel option work in a way that it simply filters certain message IDs depending on LogLevel value? Manual page does not explain, how exactly LogLevel decides what to show:

 LogLevel
         Gives the verbosity level that is used when logging messages from ssh(1).  The possible values are: QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3.  The default is
         INFO.  DEBUG and DEBUG1 are equivalent.  DEBUG2 and DEBUG3 each specify higher levels of verbose output.

Answer 1

The bulk of what you want to know is in log.c in the OpenSSH source. There is an enum variable called log_level. (Enum meaning it acts like a number under the hood, but each level is associated with an easy-to-understand name.) This log_level variable is set globally and acts as a mask for hiding logs you aren't interested in.

Then whenever something is logged, the message is also associated with an importance level, and the message + importance are given to a function called do_log.

In the do_log function, we see the following check:

if (!force && level > log_level)
    return;

It means that if the message is less important than the configured log level, this message is elided from the log output.

The do_log function does additional processing, eg using the importance level of the message to decide whether to prefix the output with fatal or whatever is appropriate.