On 10/09/2021 17:51, David Wright wrote:
Are you saying these entries could belong to an ssh client trying to connect as part of ssh handshake?When you commence your call, both you and the person at the other end probably exchange some pleasantries, which confirm that you're both who you say you are. These all get recorded too. Ssh is no different.
My messages are stamped 10:12:30 and 10:12:31. I run ntp across all hosts on the LAN. In auth.log there are no connection attempts logged between 10:10:07 and 10:14:05.
Could syslog also take time stamps from a client?