SSH events in balenaOS?

Product support balenaOS
1

I’m interested in logging SSH events (particularly login/auth events) in monitoring service. I’ve check the web and found a few resources about where sshd logs are typically stored, but had trouble finding them in my root balenaOS.
Ideally I was hoping to do a little script like this: Capturing SSH logins with Datadog events - Matthew Green to start, but the event isn’t firing for some reason and I don’t think its on Datadogs side.

I’m guessing perhaps there are some particular ways in which balena handles these?

Any tips on which folders to look in or what services could output a log around ssh events? Does it get a little screwy when multiple containers are involved consider each has its own ssh service?
Thanks :+1:

4

You may hook to the journalctl supervisor endpoint we provide and watch for SSH events from there: Journald logs. For test you may login to a device through the web dashboard and follow the logs with journalctl -f. When you connect with another terminal you should see the events printed there. You will need to process and parse those from an application container using the balena supervisor API listed above.

6

Perfect thank you! Works like a charm.