failed ssh login attempts not logged by rsyslog

[awayand]

Hi there,

I am running a pretty vanilla Debian 8.7 installation and noticed any failed sshd logins are not showing up in /var/log/auth.log. I have tried restarting sshd as well as rsyslogd, but no luck.

Anyone else have this problem? I have heard from a friend that knows a lot about computers that it is impossible to troubleshoot this kind of thing on linux and I am probably better off reinstalling. Any advice highly appreciated!

Mark

Edit: I found the solution by simply uninstalling rsyslogd and installing syslog-ng instead. Now logging works just fine. I'd still be curious to know what was causing this, rsyslogd was running as root as per ps, so it wasn't a permission problem.

[phenest]

I have heard from a friend that knows a lot about computers that it is impossible to troubleshoot this kind of thing on linux and I am probably better off reinstalling.

Edit: I found the solution by simply uninstalling rsyslogd and installing syslog-ng instead. Now logging works just fine.

I guess your friend doesn't know that much after all.