Where to find sshd logs on MacOS sierra

Question

I want to install Pseudo-Distributed HBase environment on my Mac OS Sierra (10.12.4), and it requires ssh installed and can log with ssh localhost without password. But sometimes I came across with error when I use ssh to log in. Above all are question background, and the actual question is where can I find debug logs of sshd so I could know why logging is failed in further?

As I know, Mac OS already have sshd installed and use launchd to manage it, and I know one way to output debug logs by sshd -E /var/log/sshd.log, but when I reviewed /etc/ssh/sshd_config configuration and there are two lines:

#SyslogFacility AUTH
#LogLevel INFO

I guess these two lines are used to config debug mode, then I removed # before them and set LogLevel to DEBUG3 and then restarted sshd:

$ launchctl unload -w /System/Library/LaunchDaemons/ssh.plist
$ launchctl load -w /System/Library/LaunchDaemons/ssh.plist

And then I set log path in /etc/syslog.conf:

auth.*<tab>/var/log/sshd.log

<tab> means tab character here, and reloaded the config:

$ killall -HUP syslogd

But sshd.log file can not be found in /var/log folder when I executed ssh localhost. I also tried config the /etc/asl.log:

> /var/log/sshd.log format=raw
? [= Facility auth] file sshd.log

And the result was the same, can someone help me?

Answer 1

Apple, as usual, decided to re-invent the wheel.

In super-user window

# log config --mode "level:debug" --subsystem com.openssh.sshd
# log  stream --level debug  2>&1 | tee /tmp/logs.out

In another window

$ ssh localhost
$ exit

Back in Super-user window

^C (interrupt)
# grep sshd /tmp/logs.out
2019-01-11 08:53:38.991639-0500 0x17faa85  Debug       0x0                  37284  sshd: (libsystem_network.dylib) sa_dst_compare_internal <private>@0 < <private>@0
2019-01-11 08:53:38.992451-0500 0xb47b5b   Debug       0x0                  57066  socketfilterfw: (Security) [com.apple.securityd:unixio] open(/usr/sbin/sshd,0x0,0x1b6) = 12
...
...

In super-user window, restore default sshd logging

# log config --mode "level:default" --subsystem com.openssh.sshd