Journalctl not showing all SSH connection attempts

Relating to this thread, there is no /var/log/auth.log file on manjaro, so we have to use journalctl like journalctl -u sshd | tail -n 50 to get an overview about successfully and failed login attempts with ssh.
This is working for login attempts for local devices in my network, e.g. my ssh server is computer A and my “daily used” computer is computer B: I try to connect from B to A over ssh (login with username, password and private key), i can see the login attempt with journalctl:

$ journalctl -u sshd | tail -n 1
Dez 30 11:54:41 nuc sshd[631768]: Connection closed by invalid user xyz 192.168.178.2 port 62897 [preauth]

But if i try to connect from a different device which is NOT in my local network (i.e. my smartphone with terminus) → those ssh login attempts are not stored in journalctl. Why?

System information:

$ journalctl --version
systemd 249 (249.7-2-manjaro)

$ sshd --version
unknown option – -
OpenSSH_8.8p1, OpenSSL 1.1.1l 24 Aug 2021

$ cat /etc/lsb-release
DISTRIB_ID=ManjaroLinux
DISTRIB_RELEASE=21.2.0
DISTRIB_CODENAME=Qonos
DISTRIB_DESCRIPTION=“Manjaro Linux”

Rethorical question: do you open ports on your router? If your device is unreachable from external networks it’s no chance to log anything.

Oh god damn, this is just unpleasant. Yes. This was the problem.

1 Like

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.