I have tried a few tutorials on this, but cant seem to get it to work. I would like to log user activity (change dir, upload/download file etc) for chroot users who are in a chroot jail.

My current sshd_config file entry:

   Subsystem       sftp    internal-sftp -l VERBOSE -f LOCAL6

   Match Group sftponly
           ChrootDirectory %h
           AllowTcpForwarding no
           X11Forwarding no
           ForceCommand internal-sftp -l VERBOSE -f LOCAL6

And my current /etc/rsyslog.conf entry (in the RULES section):

   $AddUnixListenSocket /user1HomeDir/dev/log
   local6.*   /var/log/sftp.log
   :programname, isequal, "internal-sftp" -/var/log/sftp.log
   :programname, isequal, "internal-sftp" ~

I have also created a /dev directory in the users home directory (same dir as their chroot dir)

I still cannot get any logs for these chrooted users. Also, these users have there shell set to /sbin/noshell (not sure if that effects this at all).


I was able to get the logging working by having my sshd_config entry as:

Subsystem       sftp    internal-sftp -l INFO

Match Group sftponly
        ChrootDirectory h%
        AllowTcpForwarding no
        ForceCommand internal-sftp -l INFO
        X11Forwarding no

Creating a dev folder in the chroot users home directory, And then creating a rsyslog config file /etc/rsyslog.d/sftplogging.conf with the entry:

#create socket in chroot user's dev floder
    $AddUnixListenSocket /data/sftp/User/home/dev/log

#log internal-sftp in a seperate file
:programname, isequal, "internal-sftp" -/var/log/sftp.log
:programname, isequal, "internal-sftp" ~

This allows me to get logs to /var/log/sftp.log, however because of the limitations of rsyslog being limited to 50 sockets, I instead attempted to change /etc/rsyslog.d/sftplogging.conf to:

$AddUnixListenSocket /data/sftp/syslog.sock

and then hardlink it into the users dev folder

ln /data/sftp/syslog.sock dev/log

After restarting rsyslog, this doenst produce any entries in sftp.log

1 Answer 1


I was writing about this subject some time ago which mentions several culprits you might encounter while trying to achieve this:


I would give a try to new configuration format for rsyslog:

input(type="imuxsock" Socket="/chroots/user/dev/log" CreatePath="on")
local3.*                                                /var/log/sftp.log

Otherwise some errors, AVCs, SELinux status and more diagnostic information would be needed.

  • I added a few edits to my original post. I was able to get it working by creating a socket in the users dev folder. I cant get it to work though by creating a socket outside the dev folder and linking it in.
    – ts1
    Jan 31, 2017 at 19:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .