280 • Monitoring and Auditing HP NonStop SSH Reference Manual
$SSH42|09Dec09 20:00:18.23|30|Host key MD5 fingerprint:
b0:c7:86:e6:63:b8:2d:4b:b7:78:84:ec:dc:33:ed:c9
$SSH42|09Dec09 20:00:18.23|30|Host key Bubble-Babble: xetig-fegyg-pidyn-babyl-kefod-
sigeh-danyb-gykyl-sebuc-curul-fuxyx
$SSH42|09Dec09 20:00:18.23|10|SSH2 Server listening on interface 0.0.0.0, port 42022
The following example shows some log messages when an SFTP client connects, issues some commands, and
disconnects:
$SSH42|09Dec09 20:15:42.96|50|10.0.0.78:3133: accepted connection from client
$SSH42|09Dec09 20:15:42.98|50|10.0.0.78:3133: client version string: SSH-2.0-
OpenSSH_3.8.1p1
$SSH42|09Dec09 20:15:43.05|40|10.0.0.78:3133: SSH session established.
$SSH42|09Dec09 20:15:43.07|20|10.0.0.78:3133: none authentication for user 'comf.us'
not allowed
$SSH42|09Dec09 20:15:43.15|40|10.0.0.78:3133: signature ok, authentication of comf.us
successful
$SSH42|09Dec09 20:15:43.17|50|10.0.0.78:3133: channel request for subsystem sftp,
launching sftp server
$SSH42|09Dec09 20:15:43.25|50|10.0.0.78:3133: launched program
\NPNS01.$US.SSH87A.SFTPSERV successfully (\NPNS01.$Z2QB:45580213)
$SSH42|09Dec09 20:17:20.24|40|10.0.0.78:3133: SSH session terminated
Incoming ssh connections are identified by the remote IP address and remote port, separated by a colon
("10.0.0.78:2928" in the above example). This log id is displayed as SESSION-LOG-ID in the output of SSHCOM
command STATUS SESSION:
% status session *
status session *
SID SESSION-LOG-ID R USER-NAME STRT-TIM CHCNT AUTH-USR
1 10.0.0.78:3133 S COMF.US 09Dec09,20:15 1 comf.us
%
Using the WHERE option with the STATUS SESSION command the session status can be filtered to display just the
status for a given session log id (while the session is still established):
% status session *, where session-log-id = "10.0.0.78:3133"
status session *, where session-log-id = "10.0.0.78:3133"
SID SESSION-LOG-ID R USER-NAME STRT-TIM CHCNT AUTH-USR
1 10.0.0.78:3133 S COMF.US 09Dec09,20:15 1 comf.us
%
Please see chapter "SSHCOM Command Reference" for details about the STATUS SESSION command.
Note: Since IPV6 address support, the session-log-id may become too large for display in the STATUS SESSION brief
output. It has been removed in SPR T0801^ABE and can be determined via STATUS SESSION *, detail. Starting with
SPR T0801^ABE, the brief output now contains the following columns: SID, R, USER-NAME, STRT-TIM (Start-time),
CHCNT(Channel-count), AUTH-USR (Authenticated user), and AUTH (Authentication-method).
Log Level
Each log message has a "level" associated with it. The level is a number between 0 and 100 and is shown immediately
after the timestamp. A lower number means a higher importance of the message. The parameters LOGLEVELFILE,
LOGLEVELCONSOLE, and LOGLEVELEMS control which messages are generated for the various log destinations
(also see next section): only log messages with a level greater than or equal than the level configured for the target will
be generated. The log level configuration should be chosen as follows:
• 50 (default): log normal operation
• 30: only log startup messages and warnings
• 70: detailed diagnostic messages. Should only be set if the additional verbosity is really required.
• 100: very detailed diagnostic messages. This configuration is not recommended for production environments as
it will create significant overhead.
To Next Page
Loading...
