Opened 12 years ago

Closed 10 years ago

#36296 closed defect (fixed)

OS X Mountain Lion has no /var/log/secure.log for sshguard to read

Reported by: essandess (Steve Smith) Owned by: nefar@…
Priority: Normal Milestone:
Component: ports Version: 2.1.2
Keywords: mountainlion Cc: robitaille@…, pixilla (Bradley Giesbrecht), nonstop.server@…, frenchja@…, skymoo (Adam Mercer), catkfr@…, cooljeanius (Eric Gallager)
Port: sshguard

Description (last modified by ryandesign (Ryan Carsten Schmidt))

For some reason, Apple has rolled up a lot of logging into syslog, including all the ssh stuff. Consequently, there is no /var/log/secure.log for sshguard to read. The current sshguard defaults results in logs that look like: 

Sep 23 03:39:01 foo com.apple.launchd[1] (org.macports.sshguard): Throttling respawn: Will start in 10 seconds
Sep 23 03:39:11 foo.bar.com sshguard[64933]: File '/var/log/secure.log' vanished while adding!
Sep 23 03:39:11 foo com.apple.launchd[1] (org.macports.sshguard): Throttling respawn: Will start in 10 seconds
Sep 23 03:39:21 foo.bar.com sshguard[65369]: File '/var/log/secure.log' vanished while adding!

The fix is to remove the line '-l /var/log/secure.log' from /opt/local/etc/sshguard/options, but I'm not sure if looking only at /var/log/system.log will capture all the stuff sshguard needs for filtering.

Change History (9)

comment:1 Changed 12 years ago by ryandesign (Ryan Carsten Schmidt)

Cc: pixilla@… added
Description: modified (diff)
Keywords: mountainlion added
Owner: changed from macports-tickets@… to nefar@…

comment:2 Changed 12 years ago by nonstop.server@…

Cc: nonstop.server@… added

Cc Me!

comment:3 Changed 12 years ago by frenchja@…

Cc: frenchja@… added

Cc Me!

comment:4 Changed 12 years ago by frenchja@…

What if /var/log/appfirewall.log is used?

comment:5 Changed 12 years ago by skymoo (Adam Mercer)

Cc: ram@… added

Cc Me!

comment:6 Changed 12 years ago by catkfr@…

Cc me

comment:7 in reply to:  6 Changed 12 years ago by larryv (Lawrence Velázquez)

Cc: catkfr@… added

Replying to catkfr@…:

Cc me

You actually have to click the “CcMe!” button next to the Cc list in order to be Cc’d on emails. I have added you to the list.

comment:8 Changed 12 years ago by cooljeanius (Eric Gallager)

Cc: egall@… added

Cc Me!

comment:9 Changed 10 years ago by pixilla (Bradley Giesbrecht)

Resolution: → fixed
Status: new → closed

See r129577

Note: See TracTickets for help on using tickets.