SSH Agents stdout/stderr "you need to be careful" - how?

In the ping thread documentation, it states:

Note that some agent launchers, most notably SSH agents, writes all stdout/stderr outputs from the agent JVM into this same log file, so you need to be careful. See JENKINS-25695.

It’s not clear to me what careful measures I need to take. My question is what is considered careful? I start the SSH agent with:

-Djava.util.logging.config.file=/path/to/logging.properties

And it contains:

# -Djava.util.logging.config.file=/path/to/logging.properties.level=ALL
handlers=java.util.logging.FileHandler
java.util.logging.FileHandler.level=ALL
java.util.logging.FileHandler.formatter=java.util.logging.SimpleFormatter
java.util.logging.FileHandler.pattern=support/jenkins-ssh-agent-%u.log
java.util.logging.FileHandler.limit=10000000
java.util.logging.FileHandler.count=50
javax.jms.connection.level=INFO
hudson.level=INFO
hudson.remoting.Launcher.level=FINE
hudson.remoting.Channel.level=FINE
hudson.slaves.ChannelPinger.level=FINE
hudson.remoting.FileSystemJarCache.level=INFO
hudson.remoting.jnlp.level=FINE
hudson.remoting.RemoteClassLoader.level=INFO
jenkins.slaves.level=FINE
hudson.slaves.level=FINE
org.jenkinsci.remoting.engine.level=FINE
jenkins.AgentProtocol.level=FINE

Would that be considered “careful”?

1 Like

The SSH agents launches the remoting process and uses stdout and stderr to communicate through the channel. Any message in the opened shell will be log in the Agent log in Jenkins. The Java setting you use to configure your remoting process will affect only the messages generated by the remoting process. The remoting process show some messages in the Jenkins Controller log related to the flow of the connection. The issue you talk about commented that the message show in the Agent logs and Jenkins Controller logs. About the warning about “you need to be careful” I guess that is about not expose sensible info in the stdout/sterr of the opened shell by SSH, I do not see other reason, the build logs are managed by the channel and is show only on build console logs.