Problem solved - it was a systemd-journald message RateLimit effect. The sshd logs so many messages that journald suppresses them: systemctl status systemd-journald May 11 19:02:50 myserver systemd-journald[303]: Suppressed 19842 messages from sshd.service May 11 19:03:03 myserver systemd-journald[303]: Suppressed 85 messages from ssh.service May 11 19:03:20 myserver systemd-journald[303]: Suppressed 25865 messages from sshd.service May 11 19:03:50 myserver systemd-journald[303]: Suppressed 15138 messages from sshd.service May 11 19:04:03 myserver systemd-journald[303]: Suppressed 148 messages from sshd.service May 11 19:04:20 myserver systemd-journald[303]: Suppressed 31797 messages from sshd.service Solution: In /etc/systemd/journald.conf change line #RateLimitBurst=1000 to RateLimitBurst=50000 Now the filtered debug log messages always show up in syslog-ng as expected. Thanks for all that supported on this. Best Regards > Gesendet: Mittwoch, 11. Mai 2022 um 17:51 Uhr > Von: "Hildegard Meier" <daku8938@xxxxxx> > I think the eating of the debug log messages could be a systemd issue (because /dev/log is a symlink to /run/systemd/journal/dev-log nowadays), > or a syslog-ng issue. The non-debug messages are continiously logged as expected. _______________________________________________ openssh-unix-dev mailing list openssh-unix-dev@xxxxxxxxxxx https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
