SSH log file location

It's normally in /var/log/auth.log, but that's for the setup part of SSH where it does authentication. Otherwise in general syslog, as accessed via 'journalctl'. You can increase the amount of debug logging in /etc/ssh/sshd_config

But usually a broken pipe means the TCP socket dropped for some reason, which is not the fault of SSH. It can be due to aggressive timeouts on NAT routers - mobile networks are notorious for that. Search for 'ssh keepalive' for details of how to make SSH send null packets back and forth every so often to prevent timeouts.

It could also be wifi related, if the wifi dropped out for some while then eventually the TCP connection would drop.

If you affected by TCP drops, 'mosh' is a tool that runs on top of SSH that automatically reconnects and maintains the connection as it was before. It also does things like caching keystrokes and replaying them when the connection comes back up.

Theo

In the journal.

journalctl -u ssh

will get you what you want. Also be sure to look at the man page for journalctl.

That's a good start. The -u ssh arguments seem to produce records of ssh server activity but nothing about outgoing client connections. In my case the problem is with an outgoing (client) session. The journalctl -u ssh command reported no ssh client activity at all. Is there a list of valid unit names somewhere?

Many thanks!

bob prohaska

If you find it, please post it here.

Ah, you didn't make it clear it was the client. Try:

ssh -vvv user@host

The client doesn’t normally log to the journal. Run your client with ‘ssh -vvv’ for debug logging from the client . However Theo has already interpreted the diagnostic; you’re probably not going to get much more out of it than that.

Server logging seems to be quite thin by default. You could try increasing the LogLevel in /etc/ssh/sshd_config (see ‘man sshd_config’ for possible values). You’ll need to restart the server for this to take effect (systemctl restart ssh).

However, empirically, it doesn’t seem to have much to say when a connection is terminated abnormally, so don’t get your hopes up.

I think Theo is probably right about what’s going on here.

systemctl list-units

systemctl list-unit-files

...snip...

I have

ServerAliveInterval 30

in my ~/.ssh/config in the header so it is set for all my connections, precisely because some of my connections were being dropped because of inactivity causing an intermediate firewall/router to close down the connection.

It's been that way for longer than I care to remember, so my memory is a bit dim, but I know I played around with some other options that didn't always seem to work.

Thank you!

bob prohaska