This article (Setting up logging for chroot users) is the only one that has helped me to get logging working for chroot'd sftp users, so huge thanks for that!

However, for some reason, my logs messages are all going to /var/log/secure and not to /var/log/sftp.log even though my /etc/rsyslog.d/sftplogging.conf file looks like this:

#create socket in chroot user's dev floder
$AddUnixListenSocket /sftproot/files/customer/live/customerlive/dev/log
$AddUnixListenSocket /sftproot/files/customer/test/customertest/dev/log
$AddUnixListenSocket /sftproot/files/customer/live/dev/log
$AddUnixListenSocket /sftproot/files/customer/test/dev/log

#log internal-sftp in a seperate file
:programname, isequal, "internal-sftp" -/var/log/sftp.log
:programname, isequal, "internal-sftp" ~

Does anyone have any ideas why this isn't logging to /var/log/sftp.log please?

  • did you create socket ? what is result from file /sftproot/files/customer/test/dev/log ? – Archemar Jul 11 '18 at 8:47
  • Thanks for replying. The result is: /sftproot/files/customer/test/dev/log: socket – Bryn Ellis Jul 16 '18 at 14:54

My configuration is a bit different, in my /etc/ssh/sshd_conf I specify a local where to send the logs:

Subsystem sftp internal-sftp -f LOCAL4 -l VERBOSE

Then I refer that local in my rsyslog.conf with

local4.* -/var/log/sshd.log

That will log my user's acctions in /var/log/sshd.log.

  • Thanks for replying. Is your user chrooted? I've always been a bit confused with the whole LOCAL3,4,5,6... thing to be honest! I don't actually know what LOCAL4 is or means which is why I steered away from that solution. – Bryn Ellis Jul 16 '18 at 14:56
  • Yes they are, I have plenty of them. If I'm not mistaken you can choose a local number which is not being used for logging anything else and take it for your logs. In my case it was 4. – YoMismo Jul 16 '18 at 15:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.