I am trying to look at failed SSH attempts, which I could do on a regular ubuntu machine by looking at /var/log/auth.log.

I've taken a look at Debian - auth.log missing from /var/log and the WSL has no /etc/syslog.conf nor does journalctl return any entries.

Why does the WSL not have auth.log and how can I monitor SSH attempts?

  • What about /var/log/secure? – Peschke May 15 '19 at 4:12
  • @Peschke said file does not exist as well – lostlostlostlostlost May 15 '19 at 4:16
  • How is the SSH service started? – muru May 15 '19 at 5:58
  • @muru service ssh start – lostlostlostlostlost May 15 '19 at 6:08
  • 1
    So when you list all currently running services, systemd comes up empty or specifically only for ssh? Try debugging this to even prove that systemd is working and you can even get the expected output for another service. Once you can prove that journalctl works try increasing the logging level of ssh to debug or higher to see if you can get more information out of it. Here is the ssh manpage. – kemotep May 17 '19 at 13:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.