SSH Reference Manual

Monitoring and Auditing
Introduction
The SSH2 process writes two kinds of messages that allow users to analyze its operation:
• Log messages are intended to show the overall functioning of such processes as startup, normal operation, and
error conditions. Log messages can be written to a file, to a console device, or an event collector process.
• Audit messages are intended to provide a view of operations executed from an auditor’s perspective. Therefore
audit messages only deal with specific events on specific objects with specific outcomes. Audit messages can be
written to a file or to a console device.
This chapter will describe the configuration and interpretation of both kinds of messages.
Additionally the status of the SSH2 process, of sessions, channels and openers can be helpful for monitoring the
operation of the SSH2 process (see STATUS commands in chapter "SSHCOM Command Reference").
Log Messages
Content of Log Messages
SSH2 writes log messages either to a terminal or to a file. The following example shows the log messages it creates
during startup:
$US SSH87A 20> RUN SSH2/name $SSH42/ ALL;SUBNET $ZTC1;PORT 42022;PTYSERVER $SSH42
$SSH42|09Dec09 20:00:17.54|20|--------------------------------------------------------
--------
$SSH42|09Dec09 20:00:17.54|10|comForte SSH2 version
T9999H06_01Dec2009_comForte_SSH2_0087
$SSH42|09Dec09 20:00:17.55|10|config file: '(none)'
$SSH42|09Dec09 20:00:17.56|20|object filename is '\NPNS01.$US.SSH87A.SSH2'
$SSH42|09Dec09 20:00:17.56|20|object subvolume is '\NPNS01.$US.SSH87A', priority is
168
...
$SSH42|09Dec09 20:00:17.69|20|dumping configuration:
...
$SSH42|09Dec09 20:00:17.76|10|SSH config database SSHCTL opened.
$SSH42|09Dec09 20:00:17.77|20|parameter SUBNET was evaluated
$SSH42|09Dec09 20:00:17.77|20|DEFINE =TCPIP^PROCESS^NAME was set to <\NPNS01.$ZTC1>
$SSH42|09Dec09 20:00:17.77|20|TCP/IP process is $ZTC1
$SSH42|09Dec09 20:00:17.84|20|DEFINE =SSH2^PROCESS^NAME was set to <\NPNS01.$SSH42>
$SSH42|09Dec09 20:00:17.84|10|Initializing SSH2 ADMIN run mode.
$SSH42|09Dec09 20:00:17.84|10|Initializing SSH2 CLIENT run mode.
$SSH42|09Dec09 20:00:17.84|10|Initializing SSH2 DAEMON run mode.
$SSH42|09Dec09 20:00:18.04|10|Loading private key from HOSTKEY
$SSH42|09Dec09 20:00:18.23|30|Host key algorithm: ssh-dss
HP NonStop SSH Reference Manual Monitoring and Auditing • 307