Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I execute a remote command thru ssh and I need to parse the output of that command. The remote stdout/stderr are forwarded fine by ssh back to my local box on the stdout/stderr of my local ssh command. However, this fails when ssh multiplexes its own status/error messages on my local stdout/stderr.

Is there a way to tell my local ssh command to send its own messages to a local file ? Or do I need to make my remote commands send their own outputs to a pair of remote files and then scp them back to parse them safely ?

share|improve this question
ssh has a -q option to suppress warning and diagnostic messages - is that any help? – RedGrittyBrick Dec 29 '12 at 13:49
No, it does not remove all messages. i.e., I am trying to write a parser that works all the time and that does not fail when I most need it (that is, when the ssh command is somewhat screwed) – mathieu Dec 29 '12 at 13:52

The SSH client has two switches to reduce/eliminate verbosity.

From man ssh:

-q       Quiet mode.  Causes all warning and diagnostic messages to be

-y       Send log information using the syslog(3) system module.  By
         default this information is sent to stderr.

The -y switch is probably what you want, but it isn't available in all versions.

Ubuntu's current version (OpenSSH_6.0p1 Debian-3ubuntu1, OpenSSL 1.0.1c 10 May 2012) supports it, but others may not.

You can save the logs regarding ssh in a different log file if you wish.

If you're using rsyslog, e.g., create the file /etc/rsyslog.d/ssh.log and save the following line to it:

:msg,contains,"ssh:" /var/log/ssh.log

Now restart rsyslog by executing the following command:

sudo service rsyslog restart

To access the logs regarding a specific ssh process with PID $PID, you can use grep:

grep "ssh\[$PID\]" /var/log/ssh.log
share|improve this answer
Is there a way to intercept the syslog traffic for a specific pid ? i.e., I also want to parse the ssh eror messages... – mathieu Dec 29 '12 at 14:50
I've updated my answer. – Dennis Dec 29 '12 at 16:00
I am sorry to be annoying but that is going to require that the log files are actually readable by the user that runs the ssh command which is unlikely to happen in practice (too much sensitive data would thus be available). I wonder if it is somewhat possible to run the ssh process with an LD_PRELOAD trick to intercept the udp packets that go to syslog before they get there. – mathieu Dec 29 '12 at 20:15
Interesting idea, but I don't know enough about that matter to help you. I guess you could either grant the users read privileges to ssh.log alone (the most sensitive information should be host names, and you could delete it every couple of minutes) or set up a background job as root that keeps track of the used PIDs and copies the information, based on the PID, in a file readable by that user only. – Dennis Dec 29 '12 at 21:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .