OpenSSH VERBOSE logging still matters, but for different reasons

At a glance

What this is: This is an analysis of how OpenSSH logging has changed and why VERBOSE still adds value when paired with event normalization.

Why it matters: It matters because identity and SOC teams need reliable SSH session evidence for investigations, but raw line-by-line logs can overcount logins, hide failed probes, and burden the SIEM.

By the numbers:

• Across six distributions, OpenSSH captures contained 697 messages at INFO and 1,321 at VERBOSE.

👉 Read TENZIR's analysis of OpenSSH VERBOSE logging and OCSF normalization

Context

SSH logging is a governance problem as much as a telemetry problem. A single login can generate multiple lines, while failed probes may generate none at lower verbosity, which makes raw message counts a poor foundation for identity investigation, audit, or SIEM billing. In practice, teams need a reliable way to answer who connected, which key or factor they used, and whether the session was legitimate.

That is where the identity angle becomes important. SSH access often sits alongside privileged account use, automation, and service access, so the logs are not just operational data but evidence for IAM and PAM oversight. TENZIR's analysis argues that the logging model changed enough that older assumptions about VERBOSE no longer map cleanly to today's OpenSSH behavior.

Key questions

Q: How should security teams handle SSH logs that split one login across multiple lines?

A: They should normalize related lines into a single session-level event before detection or retention decisions. That preserves authentication context, avoids double counting, and makes the data usable for investigation, audit, and SIEM routing. Without normalization, line-based tools will misread both successful logins and failed probes.

Q: Why do SSH logs need more than default INFO output in privileged access environments?

A: INFO can be enough for a basic successful login, but it often misses connection-only scans, offered keys, MFA step completion, and child process context. In privileged environments, those missing signals matter because they help distinguish a legitimate operator session from stolen-key misuse or automation misuse.

Q: What breaks when SSH telemetry is treated as raw log lines instead of structured events?

A: Investigation logic breaks first, because one activity can appear as several records or disappear entirely at lower verbosity. After that, detection quality suffers, cost rises, and audit trails become harder to trust. Structured events are the only reliable basis for counting sessions and attributing actions.

Q: Should organisations keep OpenSSH VERBOSE enabled in production?

A: Yes, where the pipeline can normalize and classify the output, because VERBOSE now adds session detail that default logging may not fully expose. The decision should be based on evidence quality and downstream filtering, not on the old assumption that VERBOSE only adds duplicate noise.

Technical breakdown

Why OpenSSH log lines no longer map cleanly to one login

OpenSSH emits authentication, PAM, session, and disconnect events across separate log lines, and the exact format varies by version and distribution. That means one successful login can appear as several records, while a scanner that connects and leaves before authentication may produce no INFO-level line at all. Older parser logic that assumes one line equals one event will miscount activity and miss preauthentication reconnaissance. Modern logging also shifts process names, such as sshd-session and sshd-auth, which adds another source of parsing drift.

Practical implication: normalize OpenSSH logs into session-level events before routing them to the SIEM.

What VERBOSE adds beyond default authentication evidence

The historical reason for VERBOSE was key fingerprint visibility, but OpenSSH has included that fingerprint in the default Accepted publickey line since version 6.3. Today, VERBOSE adds useful context such as child process IDs, session type, offered keys, completed MFA factors, and connection attempts that never complete authentication. Those details matter because they distinguish interactive shells from automation, expose failed key attempts, and preserve evidence of connection-only scans that INFO-level logging can suppress.

Practical implication: keep VERBOSE enabled, but only if the downstream pipeline reduces the noise into usable events.

How OCSF normalization changes the logging economics

The main operational issue is not evidence scarcity, but evidence shape. TENZIR's approach joins related SSH lines into a single OCSF Authentication or Network Activity event, which reduces duplication while preserving context. It also allows scanners and repeated probes to be grouped by source and time window before ingest, so defenders keep the forensic trail without paying for every raw line. That makes normalization a governance control for both investigation quality and SIEM cost management.

Practical implication: apply aggregation and class-based routing so security teams pay for events, not log noise.

NHI Mgmt Group analysis

SSH logging is now an identity evidence problem, not just a verbosity problem. The article shows that modern OpenSSH already emits the key details defenders once needed VERBOSE for, but those details are fragmented across multiple lines. That fragmentation creates a governance gap for IAM, PAM, and SOC teams because the control objective is session attribution, not line counting. The practical conclusion is that log design must support identity reconstruction, not just capture volume.

Normalization is the missing control layer for SSH telemetry. Raw OpenSSH output is version-sensitive and parser-hostile, which means organisations cannot rely on log level alone to produce trustworthy evidence. Joining related lines into session-level OCSF events turns telemetry into something auditors and responders can actually use. Teams should treat normalization as part of their identity observability stack, not as a back-end convenience.

Child-process attribution sharpens privileged access accountability. The addition of child PIDs and session types matters because it links a login to the actual process tree and distinguishes interactive use from automation. That is directly relevant to PAM oversight, where standing access and interactive shells carry different risk than scoped command execution. The lesson is that SSH logging should support accountability for how access was used, not only that access occurred.

Log volume compression: this is the specific operational trade-off OpenSSH teams must manage as VERBOSE becomes more detailed but less directly usable. More evidence is only valuable if the pipeline preserves identity context while collapsing duplicate records. Practitioners should pair verbosity with structured aggregation, because noisy logs without normalization simply move the burden downstream.

What this signals

For security programmes, the practical shift is toward evidence shaping rather than evidence hoarding. Teams that still forward raw SSH lines into the SIEM will keep paying to store duplicate records, while the real investigative value sits in normalized session events and controlled routing to archive or lake tiers.

Session-level observability: SSH logging is becoming a structured identity signal, and that should change how teams measure control quality. A useful programme now checks whether a login can be traced to a source, a credential, a session type, and a process tree without manual correlation.

Where SSH access intersects with privileged administration and service accounts, the logging layer also becomes part of PAM accountability. That is the point where identity observability, access governance, and cost management converge.

For practitioners

• Enable VERBOSE with a normalization plan Keep OpenSSH at VERBOSE where investigation quality matters, but only when your pipeline joins related lines into session-level events before SIEM ingestion.
• Map SSH sessions to process-tree evidence Capture child PIDs, session type, and source endpoint fields so responders can connect an SSH login to the actual command or subsystem used.
• Group repeated probe activity before ingest Aggregate invalid-user and preauthentication noise by source address and time window so repeated scans do not inflate alert volume or storage cost.
• Separate authentication events from diagnostic noise Route PAM diagnostics and other base events to lower-cost storage while preserving Authentication and Network Activity events for the SIEM.

Key takeaways

• OpenSSH logging has evolved enough that old assumptions about VERBOSE no longer explain what the setting is for.
• The real problem is not missing evidence, but fragmented evidence that inflates counts and frustrates investigation.
• Teams should normalize SSH logs into structured session events so they keep attribution detail without paying for raw-line noise.

Key terms

• Session-level event normalization: The process of combining multiple raw log lines into one structured security event that represents a single user action or connection. This reduces duplication, preserves context, and makes SSH telemetry easier to search, correlate, and route across detection, audit, and retention workflows.
• Authentication Telemetry: Authentication telemetry is the record of signups, logins, returning sessions, and other identity events generated by an auth system. It becomes useful when teams translate those events into operational signals for adoption, lifecycle health, and risk review rather than leaving them as raw logs.
• Pre-Authentication Activity: Pre-authentication activity is the set of actions and signals that occur before a user or entity completes login. These events can reveal unusual location, device, or request patterns that help investigators understand whether the authentication attempt was expected, automated, or part of an attack path.
• Process-tree attribution: The practice of linking an access event to the child process or command that actually executed after authentication. For SSH, this improves accountability by showing whether the session launched an interactive shell, a remote command, or a subsystem such as SFTP.

What's in the full article

TENZIR's full analysis covers the implementation detail this post intentionally leaves for the source:

• The full log comparison across six Linux distributions and three OpenSSH generations, including how message formats changed over time.
• The normalization pipeline that joins related SSH lines into OCSF events and separates diagnostics from security-relevant activity.
• Example parse, aggregate, and map stages for turning raw syslog into structured authentication records.
• The routing logic that sends selected events to a SIEM while preserving the rest in a data lake or archive tier.

👉 The full TENZIR post shows the log examples, normalization stages, and routing logic in detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, secrets management, and identity lifecycle controls. It is designed for practitioners who need to connect identity evidence, access governance, and operational response across real environments.