[geeks] syslog not logging user logins

[Jeff Cole]

On Mon, Oct 02, 2006 at 08:08:48PM +0100, Mike Meredith wrote:
> On Mon, 02 Oct 2006 11:48:18 -0700, Jeff Cole wrote:
> > I've got a Solaris 9 box that refuses to log ssh logins, despite the
> > fact that auth.notice    /var/adm/messages is in syslog.conf.
> > 
> > Ideas?
> 
> Well I was going to say to check that the whitespace is tab, as that
> mistake commonly bites, but seeing as you see auth.notice stuff that
> isn't the problem.

Yeah. It was just a representation of what was in the log. Not a true
cut and paste.
 
 I'd setup :-
> 
> *.debug		/var/log/everything
> 
> Just to see if that catches the ssh logins, and to check they're really
> auth.notice.

That did it. For whatever bizzare reason, they were auth.info. Which is
really strange to me, since sshd_config says:

SyslogFacility auth
LogLevel notice

Jeff

-- 
It's not working because:  the daemons! the daemons! the terrible daemons!