Locating and Exporting Linux SSH Daemon Logs
The article lists where Linux SSH daemon logs are stored on Debian/Ubuntu systems versus Red Hat-family distributions. It notes that systems relying only on the systemd journal can retrieve SSH activity through journalctl, with service names varying by distribution.
On Debian-based systems, the SSH daemon’s activity is typically recorded in /var/log/auth.log, while Red Hat-family distributions such as RHEL, Rocky, Alma, and CentOS Stream use /var/log/secure. When those files are absent, the systemd journal becomes the only source.
The journal query differs by platform: Debian-based hosts use journalctl -u ssh, whereas Red Hat-family, Fedora, and Arch systems use journalctl -u sshd. Minimal installations without rsyslog may have no traditional log file by default.
Clear guidance on SSH log locations and journal queries could help administrators and incident responders investigate unauthorized access more consistently across mixed Linux environments. Organizations running Debian/Ubuntu or Red Hat-family servers may reduce blind spots during brute-force or credential-theft probes, while audit and privacy practices may need to account for exported authentication records. The impact is likely operational rather than broad public-facing, though compromised servers could affect users whose data or services depend on them.