Topic starter
28/08/2026 12:04 pm
TL;DR: OpenSSH VERBOSE logging is still useful, but not for the old reason of capturing key fingerprints. TENZIR shows that modern OpenSSH already records enough authentication detail at INFO, while VERBOSE now adds session type, child PID, MFA steps, and connection attempts that help teams reconstruct activity without losing evidence.
Editorial analysis by NHI Mgmt Group, based on content published by TENZIR: “Join eight SSH log lines into a single OCSF event”.
Key questions
Q: What breaks when OpenSSH logs are treated as one line per login?
A: Line-by-line counting breaks because a single SSH session can produce multiple records, while some connection attempts produce none at INFO.
Q: Why does SSH logging still create risk even when authentication succeeds?
A: A successful login can still be ambiguous if defenders cannot tell whether it was an on-call engineer, an automation account, or a stolen key.
Q: What do security teams get wrong about SSH logging for privileged access?
A: A common mistake is assuming connection records alone are enough.
Practitioner guidance
- Normalise SSH logs into a single session event Join connection, authentication, PAM, and session-start lines by host, process, and child PID so one login becomes one record for detection and review.
- Retain VERBOSE where session reconstruction matters Keep VERBOSE enabled on servers where investigators need connection origin, offered keys, MFA steps, and session type to separate admin access from intrusion.
- Separate raw evidence from SIEM ingestion Route structured authentication events to the SIEM and keep the raw log stream in a lower-cost archive or lake for deeper forensic queries.
Bottom line: OpenSSH VERBOSE logging still has value, but its modern role is to preserve session context that INFO alone may not expose cleanly.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
28/08/2026 12:04 pm
SSH logging is now an event-assembly problem, not a verbosity problem. Modern OpenSSH has already moved some of the old VERBOSE value into default authentication output, so the security issue is no longer simply how much gets logged. The real challenge is reconstructing identity, process, and session context from fragmented records. For IAM and PAM teams, the control question is whether those fragments are normalised into a trustworthy session record.
A question worth separating out:
Q: How should teams balance SIEM cost and SSH forensic detail?
A: Use VERBOSE where reconstruction matters, but do not forward every raw line into the SIEM. Convert the stream into structured events, route high-value authentication records for detection, and keep the rest in an archive tier for later review. That preserves evidence while controlling ingestion cost.
👉 Read our full editorial: OpenSSH VERBOSE logging still matters, but for different reasons