[systemd-devel] Journalctl and sshd disconnects

[Jake Rooney]

Hi,

Couple of questions...

At the moment (195) journalctl  _SYSTEMD_UNIT=sshd.service prints out
most sshd logs, but skips user disconnections/logouts. These seem to
be logged under the UID of the user that logged out and are stored in
a separate journal. Why is this?

journalctl _COMM=sshd matches all logs, including disconnects, but
_EXE=/usr/sbin/sshd skips disconnections. There seems to be some
inconsistency here, so I was wondering what's the "best" way to filter
for all sshd info, rather than having to resort to dumping the journal
and grep'ing.

Thanks,

Jake