log file locking issues?

[markstos]

With the default LogFile name, it seems that two sessions would rarely (or never) try to write to the same log at the same time.

However, the log file might be changed to /var/log/user-session.log to simplify file location. In that case, every session would try to write the same file. Will this case cause a problem either because only session can write to the file at a time, or with data loss with two sessions trying to write to the same log at the same time?

[kbucheli]

If two sessions log to the same file at the same time, the content will be mixed . There is no way to distinguish the two sessions as it may change at any position. The data is treated as a stream and there is no interpretation of the content and thus no specific boundary.
There are also no timestamps, so you do not know when something happened. OK, you might have some time output in the shell prompt, but the tool itself does not help.
That is the reason why it goes some length to create unique file names including the timestamp.

[markstos]

Thanks for the reply, @kbucheli

If you don't mind me asking, how do you handle the log rotation and growth with so many potential files being generated? In my case there are dozens of logins each day, quickly exploding the number of files.

[kbucheli]

Good question. We have the same kind of problem in our installation.
You do not need log rotation as you get a new file for each session.
But still you get a lot of files you need to care about. What we do is first to have monthly subdirectories with:

LogFile = /nfsshare/sshlog/%y/%m/%h-%u-%y%m%d-%H%M%S-%c-%p.log

You may also have daily or by user directories.
We also keep our files only a limited time. So we have a cleanup cron job:

tmpwatch --mtime 31d /nfsshare/sshlog/ 2>&1 | logger -t tmpwatch -p daemon.info

Maybe I should add a hint like that to the documentation?

[markstos]

That would be very helpful. I'm not familiar with tmpwatch and I'm sure others will find the hint useful as well. I think it's also valuable to provide the context of why there are lots of files in the first place instead of just one.