I have tried a few tutorials on this, but cant seem to get it to work. I would like to log user activity (change dir, upload/download file etc) for chroot users who are in a chroot jail.

My current sshd_config file entry:

   Subsystem       sftp    internal-sftp -l VERBOSE -f LOCAL6

   Match Group sftponly
           ChrootDirectory %h
           AllowTcpForwarding no
           X11Forwarding no
           ForceCommand internal-sftp -l VERBOSE -f LOCAL6

And my current /etc/rsyslog.conf entry (in the RULES section):

   $AddUnixListenSocket /user1HomeDir/dev/log
   local6.*   /var/log/sftp.log
   :programname, isequal, "internal-sftp" -/var/log/sftp.log
   :programname, isequal, "internal-sftp" ~

I have also created a /dev directory in the users home directory (same dir as their chroot dir)

I still cannot get any logs for these chrooted users. Also, these users have there shell set to /sbin/noshell (not sure if that effects this at all).


I was able to get the logging working by having my sshd_config entry as:

Subsystem       sftp    internal-sftp -l INFO

Match Group sftponly
        ChrootDirectory h%
        AllowTcpForwarding no
        ForceCommand internal-sftp -l INFO
        X11Forwarding no

Creating a dev folder in the chroot users home directory, And then creating a rsyslog config file /etc/rsyslog.d/sftplogging.conf with the entry:

#create socket in chroot user's dev floder
    $AddUnixListenSocket /data/sftp/User/home/dev/log

#log internal-sftp in a seperate file
:programname, isequal, "internal-sftp" -/var/log/sftp.log
:programname, isequal, "internal-sftp" ~

This allows me to get logs to /var/log/sftp.log, however because of the limitations of rsyslog being limited to 50 sockets, I instead attempted to change /etc/rsyslog.d/sftplogging.conf to:

$AddUnixListenSocket /data/sftp/syslog.sock

and then hardlink it into the users dev folder

ln /data/sftp/syslog.sock dev/log

After restarting rsyslog, this doenst produce any entries in sftp.log


I was writing about this subject some time ago which mentions several culprits you might encounter while trying to achieve this:


I would give a try to new configuration format for rsyslog:

input(type="imuxsock" Socket="/chroots/user/dev/log" CreatePath="on")
local3.*                                                /var/log/sftp.log

Otherwise some errors, AVCs, SELinux status and more diagnostic information would be needed.

  • I added a few edits to my original post. I was able to get it working by creating a socket in the users dev folder. I cant get it to work though by creating a socket outside the dev folder and linking it in. – cy10n Jan 31 '17 at 19:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.