Re: [Sshguard-users] sshguard-1.5-r1 on gentoo: log entries missed

[Robert S <rob...@gm...>]

> Your backtrace seems intresting. sshguard seems waiting while performing process authentication.
> Procauth has been there for long and should be stable. Can you please try to temporary disable
> the "-f 100:/var/run/sshd.pid" and observe if you still get that? The outcome will confirm/falsify the
> insight.
>

I'm running sshguard with these options, with the SSHGUARD_DEBUG variable set:

# sshguard -l /var/log/auth.log -b
/usr/local/var/sshguard/blacklist.db -w /etc/sshguard.whitelist

I've had it running for 24hr and its still running now.  There have
been two intruders blocked over this time (there seem to be much fewer
attempted logins lately!).  I think that's fixed it.

Unfortunately no sshguard activity appears in my syslog - this feature
seems to have disappeared in recent versions of the software.  It
seems to be necessary to set the SSHGUARD_DEBUG variable, which gives
an extremely verbose debug output.  I think that this has led to my
not realising that sshguard was not working for many months before
this problem cropped up.  Is it possible to enable logging to syslog -
or to another log file?