Re: mail log question
On 2025-09-12 16:10:38 +0200, Vincent Lefevre wrote:
> On 2025-09-12 09:53:31 -0400, Greg Wooledge wrote:
> > hobbit:~$ journalctl -u ssh
> > Hint: You are currently not seeing messages from other users and the system.
> > Users in groups 'adm', 'systemd-journal' can see all messages.
> > Pass -q to turn off this notice.
> > -- No entries --
> > hobbit:~$ sudo journalctl -u ssh
> > [sudo] password for greg:
> > Mar 11 18:31:26 hobbit sshd[518764]: pam_unix(sshd:auth): check pass; user unkn>
> > [...]
>
> On my machines, I do not see any difference between root and non-root.
This appears to be what is important:
All users are granted access to their private per-user journals.
However, by default, only root and users who are members of a few
special groups are granted access to the system journal and the journals
of other users. Members of the groups "systemd-journal", "adm", and
"wheel" can read all journal files. Note that the two latter groups
traditionally have additional privileges specified by the distribution.
Members of the "wheel" group can often perform administrative tasks.
from the journalctl(1) man page.
--
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)
Reply to: