LogLevel parameter to VERBOSE or higher. This ensures that connection attempts, authentication successes, and failures are recorded in the system event logs or specific client log files. By enabling these settings, administrators can monitor software activities for security auditing and troubleshooting purposes without relying on third-party network monitoring tools.
Understanding OpenSSH Client Logging
Windows 10 and Windows 11 include an OpenSSH client by default, which is a powerful tool for establishing secure shell connections. However, by default, this client operates quietly, providing minimal feedback unless an error occurs. To gain visibility into outbound traffic, you need to adjust the configuration file that controls the client's behavior. The primary configuration file for the client is typically located at%USERPROFILE%\.ssh\config or the global location <ProgramFiles>\OpenSSH\sshd_config (note: strictly speaking, sshd_config is for the server, but clients often look for ssh_config or use command-line overrides). For persistent changes, editing the user-specific config file is the recommended approach.
The key directive here is LogLevel. The available levels range from QUIET to DEBUG3. For standard auditing of outbound connections, VERBOSE is the sweet spot. It provides detailed information about the connection process, including the remote host, port, and authentication method used, without flooding the logs with cryptographic details that DEBUG would produce. This level of detail is sufficient for identifying which applications are initiating SSH sessions and to which endpoints they are connecting.
Configuring the SSH Config File
To implement this change, you will need to create or edit the SSH configuration file. First, check if the.ssh directory exists in your user profile. If it does not, create it using PowerShell with the following command:
New-Item -ItemType Directory -Force -Path $env:USERPROFILE\.sshconfig inside it. You can do this using Notepad or any text editor. In this file, you will define the global logging settings. Add the following line to ensure all subsequent SSH commands inherit this logging behavior:
Host *
LogLevel VERBOSE*). If you only want to log connections to specific servers, you can replace the asterisk with the hostname or IP address of the target server. After saving the file, the next time you initiate an SSH connection, the client will automatically generate verbose logs. It is important to note that these logs are not written to a simple text file by default; instead, they are routed to the Windows Event Log system, specifically under the Application and Services Logs section related to OpenSSH.
Accessing the Generated Logs
With the configuration in place, you can now view the outbound connection records. Open the Event Viewer by searching for it in the Start menu. Navigate to the following path in the left-hand pane:- Applications and Services Logs
- Microsoft
- Windows
- OpenSSH
>> C:\path\to\ssh_log.txt to your SSH command. However, this method requires manual intervention for every command and does not capture background processes initiated by other applications. The Event Viewer method is superior because it captures events regardless of how the SSH client was invoked, provided the client respects the config file settings.
For more advanced scenarios, such as monitoring reverse proxies or map drive permissions, refer to our guide on Setting Persistent Reverse SSH SOCKS Proxies on Windows. This complements basic logging by helping you understand the traffic flow through established tunnels.
Troubleshooting Common Issues
Sometimes, despite correct configuration, logs may not appear as expected. A common reason is that the SSH client is being invoked by a wrapper script or another application that uses its own internal configuration mechanisms, bypassing the user-levelconfig file. In such cases, you may need to set environment variables or modify the global system-wide SSH configuration if you have administrative privileges.
Another issue arises when firewall rules interfere with the logging process itself, although this is rare since logging is a local operation. If you suspect that the Event Log service is overwhelmed, consider filtering the logs by keyword "SSH" to reduce noise. Additionally, ensure that your Windows account has read permissions to the Event Viewer logs, especially in corporate environments where Group Policy might restrict access to certain diagnostic tools.
For users experiencing hostname resolution issues that might affect logging accuracy, such as when the SSH hostname is not bound to the IP correctly, check out our article on SSH Hostname Not Bound to IP on Windows Device: Still Works?. This can help clarify whether network layer discrepancies are causing false positives in your connection logs.
Frequently Asked Questions
Where are SSH logs stored by default?
By default, OpenSSH client logs on Windows are stored in the Windows Event Viewer under Applications and Services Logs > Microsoft > Windows > OpenSSH > Operational. They are not saved as plain text files unless explicitly redirected.
Can I log only failed SSH connections?
The standard LogLevel VERBOSE setting logs both successful and failed connections. To filter only failures, you must use the Event Viewer filters to display only events with error codes or messages indicating authentication failure, as the client logs the attempt regardless of the outcome.
Does this work for PuTTY or other SSH clients?
No, these instructions apply specifically to the native Windows OpenSSH client included in Windows 10 and 11. Third-party clients like PuTTY have their own separate logging configurations, usually found in their session settings or registry keys, and do not share the same config file structure.
How do I clear old SSH logs?
You can clear old logs directly from the Event Viewer. Right-click the OpenSSH Operational log and select "Clear Log." Alternatively, you can archive the log to an EVTX file before clearing it to maintain a historical record for compliance or forensic analysis.
Is there a performance impact from enabling verbose logging?
The performance impact is negligible. Logging adds a minimal overhead to the SSH handshake process, primarily involving writing to the Event Log buffer. It does not significantly slow down the actual data transfer or encryption processes once the connection is established.