How to check sshd logs and status in linux ?

This tutorial guides you on how to check sshd logs in linux operating system. I had already installed OpenSSH 8.1 in Suse Linux Server. I will show you how to check the status of sshd and the logs.

Check status of sshd in linux

To check if sshd is up and running run the following systemctl command.

[root@sne02 ~]# systemctl status sshd
● sshd.service - OpenSSH Daemon
   Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset: disabled)
   Active: active (running) since Mon 2022-10-10 03:28:21 IST; 1 day 15h ago
 Main PID: 4114 (sshd)
    Tasks: 1
   CGroup: /system.slice/sshd.service
           └─4114 /usr/sbin/sshd -D

Oct 11 14:07:38 sne02 sshd[32078]: Accepted key RSA SHA256:YuPXYbJI8ZOMYvpoFMaj9BGwApGpotNE6J+3ad+pg7M found at /usr/sneuser/.ssh/authorized_keys:15
Oct 11 14:07:38 sne02 sshd[32078]: Postponed publickey for sneuser from 192.185.155.116 port 65141 ssh2 [preauth]
Oct 11 14:07:38 sne02 sshd[32078]: Accepted key RSA SHA256:YuPXYbJI8ZOMYvpoFMaj9BGwApGpotNE6J+3ad+pg7M found at /usr/sneuser/.ssh/authorized_keys:15
Oct 11 14:07:38 sne02 sshd[32078]: Accepted publickey for sneuser from 192.185.155.116 port 65141 ssh2: RSA SHA256:YuPXYbJI8ZOMYvpoFMaj9BGwApGpotNE6J+3ad+pg7M
Oct 11 15:01:28 sne02 sshd[25913]: Connection from 192.185.155.116 port 64562 on 192.123.217.69 port 22 prdomain ""
Oct 11 15:01:43 sne02 sshd[25913]: gkr-pam: unable to locate daemon control file
Oct 11 15:01:43 sne02 sshd[25913]: Accepted password for root from 192.185.155.116 port 64562 ssh2
Oct 11 19:16:33 sne02 sshd[27876]: Connection from 192.185.155.116 port 53603 on 192.123.217.69 port 22 prdomain ""
Oct 11 19:16:38 sne02 sshd[27876]: gkr-pam: unable to locate daemon control file
Oct 11 19:16:38 sne02 sshd[27876]: Accepted password for root from 192.185.155.116 port 53603 ssh2

How to check sshd logs in Suse Linux ?

From the above status check response, you can see that sshd logs are displayed. But, you can also run the following tail -f command tail sshd logs.

tail -f /var/log/messages | grep 'sshd'

Note, the /var/log/messages is the file where all the global system messages are logged. In order to filter the sshd logs you can grep for ‘sshd’ and check the sshd logs from that file.

That’s it. This way you can monitor the sshd logs in realtime 🙂

Permission to check sshd logs

Also, you may need permission to open /var/log/messages for reading sshd logs while running tail command. Otherwise, you may get the following error

tail: cannot open '/var/log/messages' for reading: Permission denied
tail: no files remaining

Hence, make sure you logged in as root user or having permission to read that file.

Hope this helped 🙂

Check status of sshd in linux

How to check sshd logs in Suse Linux ?

Permission to check sshd logs

References