# 7. Configuring "k9-tail" for logs \[optional]

`k9-tail` is a small program that forwards SSH logs to Key9. Key9 uses these logs to determine which public keys are used by users and for other authentication analytics. The program works by following (tailing) the /var/log/auth.log. If this is not the location of your authentication logs, it can be changed in the `/opt/k9/etc/k9.yaml`.

By default, Debian 12 does not write out an `auth.log`. The easiest way to have those logs written to disk is by installing `rsyslog`. As root, execute the following:

`apt-get install rsyslog`

To enable `k9-tail`, execute the following:

`systemctl start k9-tail`

`systemctl enable k9-tail`

Within the Key9 interface, you should see new authentication logs being received. If you are not, you can `stop` the `k9-tail` service and run `k9-tail` in debug mode. To do that, you would execute as "root":

 `/opt/k9/bin/k9-tail -debug`


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.k9.io/key9-identity/ssh/installation-and-setup/key9-ssh-for-debian-12-bookworm-howto/7.-configuring-k9-tail-for-logs-optional.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.