Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to go failed (either incorrect username, password, or both) on my server.

I changed /etc/ssh/sshd_config from

# Logging
SyslogFacility AUTH 
LogLevel INFO


# Logging
SyslogFacility AUTH 

and have since tried multiple ssh attempts with both existing and non-exisiting users with random passwords thus failing. When checking /var/log/auth.log nothing appears and it is entirely blank.

What am I missing? Does some other process need to also be install and running on my system? I'm running Ubuntu.

Any help or guidance on this matter is more than welcome.


share|improve this question

migrated from Dec 4 '12 at 1:58

This question came from our site for professional and enthusiast programmers.

This question is best suited for – Bot Dec 3 '12 at 22:15
up vote 1 down vote accepted

In general, you need a system logger. Some distributions ship with syslog-ng now days which is a complex, but flexible service for logging. It should be noted that the minimum configuration to get the described effect is not that complex:

   source src {
   source kernsrc {

   destination authlog { file("/var/log/auth.log"); };
   filter f_authpriv { facility(auth, authpriv); };
   log { source(src); filter(f_authpriv); destination(authlog); };

According to the Ubuntu community wiki, the default logging daemon is not syslog-ng in Ubuntu and the configuration file format is not as in the example above. I suggest you consider both options and pick the one which suits your needs.

After making the decision, you will need to run the logger service. Use either the service binary or run the script in /etc/init.d with the start argument. Look at this answer for hints.

share|improve this answer
Brilliant. I installed syslog-ng sudo apt-get install syslog-ng and the defaults were enough. I have also installed sshguard with it. Thanks for your help :-) – edwardgd Dec 4 '12 at 10:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .