Sponsored Content
Full Discussion: Cygwin_openssh logging
Special Forums Windows & DOS: Issues & Discussions Cygwin_openssh logging Post 302985310 by jim mcnamara on Tuesday 8th of November 2016 08:08:32 AM
Old 11-08-2016
I'm confused. What problem are you trying to solve?
For example from the cygwin forums:
Quote:
Sshd (the daemon) logs by default on the Windows Event Application list, this
can be changed in the configuration (/etc/sshd_config) so that it can log using
syslog (a separate package not installed by default).

It also logs to wtmp, you can see who loged in and from where but entries are
not distinguishable from telnet/ftp/or any other logins.

One example of failed login in the event log (very common when somebody tries to
"break" into your computer) is (6 events):

The description for Event ID ( 0 ) in Source ( sshd ) cannot be found. The local
computer may not have the necessary registry information or message DLL files to
display messages from a remote computer. You may be able to use the /AUXSOURCE=
flag to retrieve this description; see Help and Support for details. The
following information is part of the event: sshd : PID 2868 : Invalid user lidia
from 61.129.117.112.
If so, search the cygwin.com site for your problem. I am not an expert on cygwin authentication and logging. It is somewhat unlike other unixes.
 

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Logging

I have a SCO R5 Open Server Box running at a remote location, and from time to time it seems to "spontaneously" re-boot itself. Is there a specific log file that I can examine to see why the machine is doing this ? Any suggestions gratefully appreciated (1 Reply)
Discussion started by: pcs7088
1 Replies

2. Shell Programming and Scripting

Logging

G'day Just wondering if anyone out there knows how to log files, using the example I provided in the earlier message / question earlier today: :confused: If I was to backup a file, how could I setup a log file to record the filename, date (This one I've got figured), and that the file was... (4 Replies)
Discussion started by: Aussie_Bloke
4 Replies

3. Cybersecurity

logging

is there a log/ how do i make a log that logs every packet inbound or outbound through my server? I want every packet or packet fragment to be logged that comes to my server. (5 Replies)
Discussion started by: The Fridgerator
5 Replies

4. UNIX for Dummies Questions & Answers

logging when someone changes to su

Is there a file that captures info whenever someone logs to su? i know it comes across as standard output on the server, but is it saved anywhere? Time and date info included?? thanks, kym (1 Reply)
Discussion started by: kymberm
1 Replies

5. UNIX for Dummies Questions & Answers

Asking about logging in

Hi, just wriiten a sh script and as my script will try to log into another server to delete some files but when i run , it keeps on saying that my files do not exist. It seems to refer to my local directory instead. Below is my script : FTP_HOST=ip_number FTP_USER="user password" ... (1 Reply)
Discussion started by: blueberry80
1 Replies

6. UNIX for Dummies Questions & Answers

need more logging

Hi all! On our current Solaris 8 machine we only have "standard" logging configured, and now i need to put on more. What i specificly need is time in the logfiles. Ex. When a user is logging in, when a user makes it self SU. etc. Regards... dOzY (3 Replies)
Discussion started by: dozy
3 Replies

7. Programming

Logging

Hi How to manage logging in an application. Actually I am developing a Client-Server application in c/c++ and want to manage an optional logging in my application, but since prior I have never done ths activity. Plz guide me. thanks. (2 Replies)
Discussion started by: sumsin
2 Replies

8. Post Here to Contact Site Administrators and Moderators

Constant Logging In (After Logging Out)

Hi Everyone. First, I want to thank all of you for letting me participate in this great group. I am having a bit of a problem. After I get an email from a responder, I login to make my reply. In the mean time I get another response by email from another member, I go to reply to them and I... (6 Replies)
Discussion started by: Ccccc
6 Replies

9. Linux

Syslog not logging successful logging while unlocking server's console

When unlocking a Linux server's console there's no event indicating successful logging Is there a way I can fix this ? I have the following in my rsyslog.conf auth.info /var/log/secure authpriv.info /var/log/secure (1 Reply)
Discussion started by: walterthered
1 Replies

10. Windows & DOS: Issues & Discussions

Cygwin_openssh time stamps

I've installed cygwin_openssh on Windows 2012 R2 and it's working great. My issue is when a file is uploaded say from a different timezone, when it is uploaded, it doesnt pick up the sftp servers time.. Is there a way to fix that? i.e. When someone in PST uploads a file to this server in EST,... (0 Replies)
Discussion started by: MikeAdkins
0 Replies
syslog.conf(4)						     Kernel Interfaces Manual						    syslog.conf(4)

NAME
syslog.conf - syslogd configuration file SYNOPSIS
facility.severity destination Where: Is part of the system generating the message, specified in /usr/include/sys/syslog_pri.h. See also the syslogd(8) reference page. The severity level, which can be emerg, alert, crit, err, warning, notice, info, or debug. See /usr/include/sys/syslog_pri.h. The syslogd daemon logs all messages of the specified severity level plus all messages of greater severity. For example, if you specify level err, all messages of levels err, crit, alert, and emerg or panic are logged. A local file pathname to a log file, a host name for remote logging or a list of users. In the latter case the users will receive messages when they are logged in. An asterisk (*) causes a message to be sent to all users who are currently logged in. DESCRIPTION
The /etc/syslog.conf file is a system file that enables you to configure or filter events that are to be logged by syslogd. You can specify more than one facility and its severity level by separating them with semicolons. You can specify more than one facility logs to the same file by separating the facilities with commas, as shown in the EXAMPLES section. The syslogd daemon ignores blank lines and lines that begin with an octothorpe (#). You can specify # as the first character in a line to include comments in the file or to disable an entry. The facility and severity level are separated from the destination by one or more tab characters. If you want the syslogd daemon to use a configuration file other than the default, you must specify the file name with the following com- mand: # syslogd -f config_file Daily Log Files You can specify in the /etc/syslog.conf file that the syslogd daemon create daily log files. To create daily log files, use the following syntax to specify the path name of the message destination: /var/adm/syslog.dated/ { file} The file variable specifies the name of the log file, for example, mail.log or kern.log. If you specify a /var/adm/syslog.dated/file path name destination, each day the syslogd daemon creates a sub-directory under the /var/adm/syslog.dated directory and a log file in the sub-directory, using the following syntax: /var/adm/syslog.dated/ date / file Where: The date variable specifies the day, month, and time that the log file was created. The file variable specifies the name of the log file you previously specified in the /etc/syslog.conf file. The syslogd daemon automatically cre- ates a new date directory every 24 hours and also when you boot the system. The current directory is a link to the latest date directory. To get the latest logs, you only need to reference the /var/adm/syslog.dated/current directory. EXAMPLES
The following is a sample /etc/syslog.conf file: # # syslogd config file # # facilities: kern user mail daemon auth syslog lpr binary # priorities: emerg alert crit err warning notice info debug # kern.debug /var/adm/syslog.dated/kern.log user.debug /var/adm/sys- log.dated/user.log daemon.debug /var/adm/syslog.dated/daemon.log auth.crit;syslog.debug /var/adm/syslog.dated/syslog.log mail,lpr.debug /var/adm/syslog.dated/misc.log msgbuf.err /var/adm/crash.dated/msgbuf.savecore kern.debug /var/adm/messages kern.debug /dev/console *.emerg * FILES
/etc/syslog.conf /etc/syslog.auth - Authorization file for remote logging. /usr/include/sys/syslog_pri.h - Common components of a syslog event log record. RELATED INFORMATION
Commands: /usr/sbin/syslogd(8), /usr/sbin/binlogd(8) System Administration delim off syslog.conf(4)
All times are GMT -4. The time now is 06:10 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy