I use Ubuntu 11.10. And I want it to write logging messages about failed ssh log in attempts to /var/log/auth.log. In my understanding /var/log/auth.log is supposed to hold all failed ssh connection attempts.

How am I supposed to do? (What do I need to check? How can I configure my machine?)

:~$ sudo ls -al /var/log/auth.log
-rw-r----- 1 syslog adm 0 2011-09-11 06:25 /var/log/auth.log
:~$ sudo ls -al /var/log/wtmp
-rw-rw-r-- 1 root utmp 15744 2013-03-21 18:09 /var/log/wtmp

Currently /var/log/wtmp is handled very well as you could find it above. But /var/log/auth.log is EMPTY. I'd like my machine handle /var/log/auth.log as it is supposed to be.

Thank you in advance.


I checked /etc/rsyslog.conf And I found someone switched it with an unknown .conf file. But the original .conf file was saved with a different name - /etc/rsyslog.conf.original

This had been done before I start using of my virtual server service. Yes I use virtual server service.

The service operator or administrator did this into the images they provide. And I don't know why they do this. And I wonder why they do this.

Just with recovering to the original .conf file my problem is solved.

Thank you for your concern.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.