Troubleshooting

"PyYAML is required: pip install pyyaml"

Install it for the Python you run sshsentry with: sudo apt install python3-yaml, sudo dnf install python3-pyyaml, or a venv.

"note: country checks disabled"

geoip2 or the GeoLite2 database is missing. Harmless; install both to enable the new-country rule.

No alerts at all

The first run is a silent baseline, so try --replay on the sample log. Check it is running as root and reading the right file (--log to override).

No /var/log/auth.log or /var/log/secure

Your system logs only to journald. Install rsyslog, or export with journalctl -u ssh -o short > file and use --replay.

Email or Slack never arrives

Run --test-alerts: it prints a result per destination and exits 1 on failure. Check the startup warnings (bad URL, missing SMTP settings, missing password env var). Add the sender to your contacts to avoid spam folders.

Too many LOW alerts for my own logins

Approve your addresses: sshsentry --approve IP, or set min_severity: MEDIUM on a destination.

Brute-force threshold feels wrong

Turn on learn mode for a few days and run --suggest-threshold. Treat the number as information; on internet-facing servers it tends to be higher than 5.

Found a parser gap? Open an issue with a redacted log line.