Is there a way to log which IP-address uploads files through sFTP in Redhat? The users sign in with SSH, so I can see their IP's in /var/log/secure.

But is there a log for the built in sFTP-server, so I can see either what username or what IP uploaded each file, or is there a way to monitor this?

I already have incrond to run a script when a file in the sFTP folder is changed, but this is run on the user owning the files, and doesn't know which user changed it.

I don't know what the standard sFTP client is called, but perhaps there is some other standard sFTP-server that has more logging than this one?

  • duplicate of serverfault.com/questions/73319/sftp-logging-is-there-a-way
    – Marcel
    Commented Sep 12, 2018 at 9:40
  • Be consistent. In title you write FTP, while elsewhere you write SFTP. FTP and SFTP are two completely different protocols with different deamons and logs. And why "sFTP" - lowercase "s"? Commented Sep 12, 2018 at 10:16
  • I guess since this question is duplicate, should I remove it? sFTP, not sure, thought it was written that way. :)
    – Niclas
    Commented Sep 12, 2018 at 11:03

1 Answer 1


I found no option in internal-sftp to force log.

in /etc/ssh/sshd_config, use

Subsystem sftp internal-sftp -f  USER -l INFO

then use syslog.conf to trap USER.INFO file in a custom file.

in /etc/syslog.conf

user.info /var/log/my-sftp.log

as mention here, you can use either internal-sftp or


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .