I have been trying to write a program to execute many commands during one ssh connection.

My current way is (1) create SSH connection; (2) create SSH command tunnel/channel whenever needed; (3) close SSH connection.

As expected, I see only two entries in /var/log/secure, corresponding to the ssh open & close event.

My problem is that there are many entries in /var/log/wtmp, corresponding to the log in & out event.

Could you help to comment on the relationships between these two file, in the context of recording SSH connections?

Any insight is appreciated! Sorry for the trouble if the terminology is not appropriate!


Log entries in /var/log/secure track authentication events. An authentication event happens whenever you open an SSH connection. These entries may also appear in /var/log/auth.log, /var/log/syslog, /var/log/daemon.log, /var/log/messages and other text mode log files that may exist depending on the system configuration; different distributions have different defaults in this regard.

When you do something over an existing SSH connection, including opening a tunnel or a slave connection, that does not require any authentication step. Therefore there is no recording of that in /var/log/secure.

Entries in /var/log/wtmp (and utmp) record the creation and destruction of terminals, or the assignment and release of terminals to users. Thus they track interactive sessions only. On some setups, every creation of a terminal by a terminal emulator is recorded there. An SSH connection triggers logging in utmp and wtmp if and only if it creates a terminal (i.e. if you don't pass a command and thus get an interactive shell, or if you run ssh -t).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.