Missing syslog entries for OpenSSH

Question

I would like to save the log for OpenSSH client. The manual says that I can use

ssh -y example.com

to turn on logging. Configuration manual says that the default Syslog facility is user; I didn't touch it in /etc/ssh/ssh_config or ~/.ssh/config. In addition, my syslog config has

user.* /var/log/user.log;RSYSLOG_TraditionalFileFormat

so I expect to find my SSH logs in /var/log/user.log. However, I tried ssh -y, and there’s no “ssh” in that file. I also tried

journalctl -t ssh

It seems to be for sshd, not for the client. Is this expected? Any one made client-side SSH syslog working?

Or is there any more configuration I need to check/add?

I found this question but it’s about server-side logging, and it is about changing the Syslog facility. I don’t care about Syslog facility, as long as there is some log there.

Answer 1

In Configuration manual it's also stated that default loglevel is INFO

LogLevel
Gives the verbosity level that is used when logging messages from ssh(1). The possible values are: QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. The default is INFO. DEBUG and DEBUG1 are equivalent. DEBUG2 and DEBUG3 each specify higher levels of verbose output.

So it could be worth trying to increase the loglevel according to your needs.
Below examples with debug level.

Via command line according to manual:
ssh -v -y example.com

-v
Verbose mode.
Causes ssh to print debugging messages about its progress. This is helpful in debugging connection, authentica‐ tion, and configuration problems. Multiple -v options increase the verbosity. The maximum is 3.

Via ssh_config according to Configuration manual:
LogLevel DEBUG

LogLevel
Gives the verbosity level that is used when logging messages from ssh(1). The possible values are: QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. The default is INFO. DEBUG and DEBUG1 are equivalent. DEBUG2 and DEBUG3 each specify higher levels of verbose output.