> For the complete documentation index, see [llms.txt](https://docs.k9.io/key9-identity/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.k9.io/key9-identity/ssh/installation-and-setup/key9-ssh-for-debian-12-bookworm-howto/7.-configuring-k9-tail-for-logs-optional.md).

# 7. Configuring "k9-tail" for logs \[optional]

`k9-tail` is a small program that forwards SSH logs to Key9. Key9 uses these logs to determine which public keys are used by users and for other authentication analytics. The program works by following (tailing) the /var/log/auth.log. If this is not the location of your authentication logs, it can be changed in the `/opt/k9/etc/k9.yaml`.

By default, Debian 12 does not write out an `auth.log`. The easiest way to have those logs written to disk is by installing `rsyslog`. As root, execute the following:

`apt-get install rsyslog`

To enable `k9-tail`, execute the following:

`systemctl start k9-tail`

`systemctl enable k9-tail`

Within the Key9 interface, you should see new authentication logs being received. If you are not, you can `stop` the `k9-tail` service and run `k9-tail` in debug mode. To do that, you would execute as "root":

 `/opt/k9/bin/k9-tail -debug`