topic Re: sshd messages after update in Network Security

sshd messages after update

renateneike — Tue, 03 Feb 2026 07:20:24 GMT

Hello,

I have a FPR-4112-K9 firewall cluster with software version 2.16(1.147). It runs an ASA cluster with software version 7.22(1).
Since updating to the above versions two weeks ago, I get the following messages when logging in with ssh:
Firepower:

%AUTH-3-SYSTEM_MSG: error: Unable to load host key: /isan/etc/ssh_host_ecdsa_key - sshd[31426]
%DAEMON-3-SYSTEM_MSG: error: lastlog_openseek: couldn't stat /var/log/lastlog: No such file or directory - sshd[31467]

ASA:

%ASA-3-199015: 3 February 07:22:43 sshd: PAM unable to resolve symbol: pam_sm_setcred
%ASA-3-199015: 3 February 07:22:50 sshd: pam_lastlog(sshd:session): unable to open /var/log/btmp: No such file or directory

What can I do about this?

On my data centre switches (Nexus9000), I was able to start bash and create /var/log/btmp. That doesn't work here.

Many thanks in advance.

Re: sshd messages after update

balaji.bandi — Tue, 03 Feb 2026 07:54:55 GMT

On FXOS, you may need to regenerate the FXOS SSH keys. This forces the system to re-create the missing file pointers.

check guide :

https://www.cisco.com/c/en/us/td/docs/security/firepower/fxos/2120/web-guide/b_GUI_FXOS_ConfigGuide_2120/platform_settings.html#task_B6475127711E46A698F40865FDC44C38

ASA cluster with software version 7.22(1).

I'm taking this as ASA code 9.22; I may try to recreate the SSH key from the console and test

example :

no ssh version 2
ssh version 2
crypto key generate rsa modulus 2048

Re: sshd messages after update

Mark Elsen — Tue, 03 Feb 2026 08:12:04 GMT

- @renateneike FYI : https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwc17197

Re: sshd messages after update

renateneike — Tue, 03 Feb 2026 10:02:55 GMT

Does this workaround affect the current ssh session? I only have remote access with ssh.

Re: sshd messages after update

renateneike — Tue, 03 Feb 2026 10:07:34 GMT

Oh yes, ASA code 9.22(2)20 is installed.

But what happens to my current SSH connection? I only have remote access.

Re: sshd messages after update

balaji.bandi — Tue, 03 Feb 2026 11:11:41 GMT

It's safe to do from the console. If you already have an SSH connection, what is the issue? Is that only the Logs that are the issue?

You can ignore the log discriminator to report on the console.

Re: sshd messages after update

renateneike — Tue, 03 Feb 2026 11:32:26 GMT

These are only messages that come to the monitoring server. The SSH connections work without any problems.

Re: sshd messages after update

Mark Elsen — Tue, 03 Feb 2026 11:39:22 GMT

- @renateneike The workaround does not affect the current SSH session ,

Re: sshd messages after update

balaji.bandi — Tue, 03 Feb 2026 11:54:48 GMT

You can remove sending logs to the syslog server -

no logging message 199015

lower the severity.

logging message 199015 level X

Re: sshd messages after update

renateneike — Tue, 03 Feb 2026 12:16:06 GMT

Thanks, the level is now Notification and that's fine. 😊

Re: sshd messages after update

renateneike — Wed, 04 Feb 2026 06:40:18 GMT

Thank you very much for your help. Everything has worked well so far.
Now I have this message:

%DAEMON-3-SYSTEM_MSG: error: lastlog_openseek: couldn't stat /var/log/lastlog: No such file or directory - sshd[31467]

How can I get rid of it? Can I create /var/log/lastlog?

Re: sshd messages after update

Mark Elsen — Wed, 04 Feb 2026 06:52:13 GMT

- @renateneike Get a shell on your device and issue these commands :
sudo touch /var/log/lastlog
chmod 600 /var/log/lastlog