2

I'm on CentOS v6.4 and using its native FTP Server, which i suppose is sftp. (Am i right?) Now i can use FTP well. But i need to log the actions taken by Users.

Logs for the actions, such us, who logged in, who modified which files, who deleted which files .. etc the basically important actions, you know.

So my simple questions would be:

  • Where & how can i access/check the FTP Logs from Server, please?
  • Can it even be done with default SFTP? (Do i need vsftpd?)

In short words, what is the best & simplest way to get the FTP Logging, please?

11

You can log sftp, try this:

In /etc/ssh/sshd_config file, change this line:

Subsystem       sftp    /usr/libexec/openssh/sftp-server

to:

Subsystem       sftp    /usr/libexec/openssh/sftp-server -l INFO -f AUTH

Then config syslog log facility AUTH to your file. In Centos 6. edit /etc/rsyslog.conf, add this line:

auth.*    /var/log/sftp.log

After making these changes reload (kill -HUP) or restart sshd and restart rsyslog for them to take effect.

  • Updated answer! – cuonglm Feb 27 '14 at 2:14
  • Oh ok, then after that, what should i do please? RESTART some services? – 夏期劇場 Feb 27 '14 at 3:00
  • Yes, restart sshd and rsyslog services to make the changes. – cuonglm Feb 27 '14 at 3:05
  • Thanks so much, for the updates as well. I have ACCEPTED it already! (Since seems you have a good experience in this) Can i please add some comments to ask that, in this LOGS, (1) why can't i see the user's name, instead of just logging the activities only? (2) is there a log size or retention limit on this log-file please? (up to how long can i keep the logs in this file?) Thanks much again!! – 夏期劇場 Feb 27 '14 at 3:16
  • -l DEBUG still can't help, to describe WHICH USER. And what you mean by logrotate please? :) – 夏期劇場 Feb 27 '14 at 3:30
1

Mmmmm..but now there are another problem. /var/log/sftp.log grows without control... Add entry to /etc/logrote.d/sftp

/var/log/sftp.log
{
    rotate 24
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}
  • /etc/logrotate.d/sftp instead of /etc/logrote.d/sftp – dstonek Oct 3 '18 at 22:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.