How to Find SSHD/Systemd Socket-Activated Logs on CentOS

centoslogssshdsystemd

I'm trying to view the logs for my SSH server (CentOS 7) but cannot seem to find them. It's configured to use the systemd socket activation. I normally expect to find them with journalctl -b -u sshd.service but since that service isn't being used, all it gives me is -- No entries --. Getting the logs of the socket aren't any more useful:

$ journalctl -b -u sshd.socket
-- Logs begin at Thu 2019-03-21 08:46:19 EDT, end at Thu 2019-03-21 08:55:24 EDT. --
Mar 21 08:46:38 gbox systemd[1]: Listening on OpenSSH Server Socket.

and that's it. I have systemd logging to the serial console, and there I see messages such as:

Mar 21 08:57:35 gbox systemd: Started OpenSSH per-connection server daemon (69.00.00.228:19212).

so….. why can't I see these in systemd/journald? Where do they live? How can I diagnose per-connection SSH daemon logs?

Edit: I know there's an active connection right now since I'm currently running these commands over SSH.

Best Answer

sshd.socket is set up using Accept=true. This means it starts instances of a template unit called sshd@.service.

journalctl -b -u sshd@*.service