Notifications
Clear all
Topic starter
28/08/2026 12:04 pm
TL;DR: OpenSSH VERBOSE logging is still useful, but not for the old reason of capturing key fingerprints. TENZIR shows that modern OpenSSH already records enough authentication detail at INFO, while VERBOSE now adds session type, child PID, MFA steps, and connection attempts that help teams reconstruct activity without losing evidence.
NHIMG editorial — based on content published by TENZIR: OpenSSH VERBOSE logging still matters, but for different reasons
By the numbers:
- Across six distributions, OpenSSH captures contained 697 messages at INFO and 1,321 at VERBOSE.
Questions worth separating out
Q: How should security teams handle SSH logs that split one login across multiple lines?
A: They should normalize related lines into a single session-level event before detection or retention decisions.
Q: Why do SSH logs need more than default INFO output in privileged access environments?
A: INFO can be enough for a basic successful login, but it often misses connection-only scans, offered keys, MFA step completion, and child process context.
Q: What breaks when SSH telemetry is treated as raw log lines instead of structured events?
A: Investigation logic breaks first, because one activity can appear as several records or disappear entirely at lower verbosity.
Practitioner guidance
- Enable VERBOSE with a normalization plan Keep OpenSSH at VERBOSE where investigation quality matters, but only when your pipeline joins related lines into session-level events before SIEM ingestion.
- Map SSH sessions to process-tree evidence Capture child PIDs, session type, and source endpoint fields so responders can connect an SSH login to the actual command or subsystem used.
- Group repeated probe activity before ingest Aggregate invalid-user and preauthentication noise by source address and time window so repeated scans do not inflate alert volume or storage cost.
What's in the full article
TENZIR's full analysis covers the implementation detail this post intentionally leaves for the source:
- The full log comparison across six Linux distributions and three OpenSSH generations, including how message formats changed over time.
- The normalization pipeline that joins related SSH lines into OCSF events and separates diagnostics from security-relevant activity.
- Example parse, aggregate, and map stages for turning raw syslog into structured authentication records.
- The routing logic that sends selected events to a SIEM while preserving the rest in a data lake or archive tier.
👉 Read TENZIR's analysis of OpenSSH VERBOSE logging and OCSF normalization →
OpenSSH VERBOSE logging: what IAM and SOC teams need now?
Explore further
28/08/2026 12:04 pm
SSH logging is now an identity evidence problem, not just a verbosity problem. The article shows that modern OpenSSH already emits the key details defenders once needed VERBOSE for, but those details are fragmented across multiple lines. That fragmentation creates a governance gap for IAM, PAM, and SOC teams because the control objective is session attribution, not line counting. The practical conclusion is that log design must support identity reconstruction, not just capture volume.
A question worth separating out:
Q: Should organisations keep OpenSSH VERBOSE enabled in production?
A: Yes, where the pipeline can normalize and classify the output, because VERBOSE now adds session detail that default logging may not fully expose. The decision should be based on evidence quality and downstream filtering, not on the old assumption that VERBOSE only adds duplicate noise.
👉 Read our full editorial: OpenSSH VERBOSE logging still matters, but for different reasons
