[solved] LogLevel debug2 handshake logging only on some logins, not on every login of a user

[Hildegard Meier]

Problem solved - it was a systemd-journald message RateLimit effect.

The sshd logs so many messages that journald suppresses them:

systemctl status systemd-journald

May 11 19:02:50 myserver systemd-journald[303]: Suppressed 19842 messages from sshd.service
May 11 19:03:03 myserver systemd-journald[303]: Suppressed 85 messages from ssh.service
May 11 19:03:20 myserver systemd-journald[303]: Suppressed 25865 messages from sshd.service
May 11 19:03:50 myserver systemd-journald[303]: Suppressed 15138 messages from sshd.service
May 11 19:04:03 myserver systemd-journald[303]: Suppressed 148 messages from sshd.service
May 11 19:04:20 myserver systemd-journald[303]: Suppressed 31797 messages from sshd.service

Solution:

In /etc/systemd/journald.conf change line
#RateLimitBurst=1000
to
RateLimitBurst=50000

Now the filtered debug log messages always show up in syslog-ng as expected.

Thanks for all that supported on this.

Best Regards

> Gesendet: Mittwoch, 11. Mai 2022 um 17:51 Uhr
> Von: "Hildegard Meier" <daku8938 at gmx.de>
> I think the eating of the debug log messages could be a systemd issue (because /dev/log is a symlink to /run/systemd/journal/dev-log nowadays),
> or a syslog-ng issue. The non-debug messages are continiously logged as expected.