I'm trying to view the logs for my SSH server (CentOS 7) but cannot seem to find them. It's configured to use the systemd socket activation. I normally expect to find them with journalctl -b -u sshd.service but since that service isn't being used, all it gives me is -- No entries --. Getting the logs of the socket aren't any more useful:

$ journalctl -b -u sshd.socket
-- Logs begin at Thu 2019-03-21 08:46:19 EDT, end at Thu 2019-03-21 08:55:24 EDT. --
Mar 21 08:46:38 gbox systemd[1]: Listening on OpenSSH Server Socket.

and that's it. I have systemd logging to the serial console, and there I see messages such as:

Mar 21 08:57:35 gbox systemd: Started OpenSSH per-connection server daemon (

so..... why can't I see these in systemd/journald? Where do they live? How can I diagnose per-connection SSH daemon logs?

Edit: I know there's an active connection right now since I'm currently running these commands over SSH.


sshd.socket is set up using Accept=true. This means it starts instances of a template unit called sshd@.service.

journalctl -b -u sshd@*.service

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.