3

I'm on CentOS v6.4 and using its native FTP Server, which i suppose is sftp. (Am i right?) Now i can use FTP well. But i need to log the actions taken by Users.

Logs for the actions, such us, who logged in, who modified which files, who deleted which files .. etc the basically important actions, you know.

So my simple questions would be:

  • Where & how can i access/check the FTP Logs from Server, please?
  • Can it even be done with default SFTP? (Do i need vsftpd?)

In short words, what is the best & simplest way to get the FTP Logging, please?

2 Answers 2

14

You can log sftp, try this:

In /etc/ssh/sshd_config file, change this line:

Subsystem       sftp    /usr/libexec/openssh/sftp-server

to:

Subsystem       sftp    /usr/libexec/openssh/sftp-server -l INFO -f AUTH

Then config syslog log facility AUTH to your file. In Centos 6. edit /etc/rsyslog.conf, add this line:

auth.*    /var/log/sftp.log

After making these changes reload (kill -HUP) or restart sshd and restart rsyslog for them to take effect.

10
  • Updated answer!
    – cuonglm
    Commented Feb 27, 2014 at 2:14
  • Oh ok, then after that, what should i do please? RESTART some services? Commented Feb 27, 2014 at 3:00
  • Yes, restart sshd and rsyslog services to make the changes.
    – cuonglm
    Commented Feb 27, 2014 at 3:05
  • Thanks so much, for the updates as well. I have ACCEPTED it already! (Since seems you have a good experience in this) Can i please add some comments to ask that, in this LOGS, (1) why can't i see the user's name, instead of just logging the activities only? (2) is there a log size or retention limit on this log-file please? (up to how long can i keep the logs in this file?) Thanks much again!! Commented Feb 27, 2014 at 3:16
  • -l DEBUG still can't help, to describe WHICH USER. And what you mean by logrotate please? :) Commented Feb 27, 2014 at 3:30
3

Mmmmm..but now there are another problem. /var/log/sftp.log grows without control... Add entry to /etc/logrotate.d/sftp

/var/log/sftp.log
{
    rotate 24
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}
1
  • /etc/logrotate.d/sftp instead of /etc/logrote.d/sftp
    – dstonek
    Commented Oct 3, 2018 at 22:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .