Set LogLevel to VERBOSE

SSHD/LogLevel

The LogLevel SSHD configuration defines the verbosity level that is used when logging messages from SSHD. The possible values are: 'QUIET', 'FATAL', 'ERROR', 'INFO', 'VERBOSE', 'DEBUG', 'DEBUG1', 'DEBUG2', and 'DEBUG3'. Logging with a DEBUG level violates the privacy of users and is not recommended. The default is INFO.

Why you should use VERBOSE LogLevel

The VERBOSE LogLevel increases the detail of information collected, such as login attempts and SSH key fingerprints. The extra information improves coverage in the analysis of logs and helps to identify possible attacks or suspicious traffic.

How to set LogLevel to VERBOSE

You need to add or change a setting at the SSHD configuration file.

Look for LogLevel at /etc/ssh/sshd_config:

grep LogLevel /etc/ssh/sshd_config

If the output isn’t empty, the argument is present in the file. Edit the file /etc/ssh/sshd_config and replace the current LogLevel value for VERBOSE. If the line is commented (contains a leading #), uncomment it removing the leading #.

If the output is empty, this argument could still be defined in a .conf file at /etc/ssh/sshd_config.d/. Check there too:

grep LogLevel /etc/ssh/sshd_config.d/*.conf
The /etc/ssh/sshd_config.d/ directory doesn’t exist at Ubuntu 18.04, you only need to check it if you`re using Ubuntu 20.04 or more recent.

If the output isn’t empty, edit the file where the argument is defined, changing its value to no.

If you couldn’t find the argument definition anywhere, edit the file /etc/ssh/sshd_config and include the following line:

LogLevel VERBOSE

Finally, restart the SSHD service:

sudo systemctl restart sshd