6

Where can I find log messages for sftp? I want to find all log messages related to sftp-server - file sent, file received.

0

1 Answer 1

7

Please read man sftp-server. In that manual page you can read about directive log_level which defaults to ERROR. If you set log_level to INFO or VERBOSE, transactions will be logged.

So by default, these kind of messages are not logged.

To enable logging edit the file /etc/ssh/sshd_config and look for:

Subsystem   sftp    /usr/lib/openssh/sftp-server

Append -l INFO to the line, save and exit. Then restart sshd using systemctl restart ssh

Try an sftp action and have a look at /var/log/auth.log for messages like:

Dec  6 15:11:47 myhost sftp-server[4674]: open "/home/myuser/testfile" flags READ mode 0666
Dec  6 15:11:47 myhost sftp-server[4674]: close "/home/myuser/testfile" bytes read 8 written 0

When using sftp-server in a chroot-ed environment the following also applies:

On some systems, sftp-server must be able to access /dev/log for logging to work, and use of sftp-server in a chroot configuration therefore requires that syslogd(8) establish a logging socket inside the chroot directory.

By default sftp-server uses AUTH as log facility. Check the logging configuration to verify if logging for AUTH is configured. For example for rsyslog:

$ grep auth /etc/rsyslog.d/50-default.conf 
auth,authpriv.*         /var/log/auth.log
3
  • I tried doing this. I do not see any kind of messages in the 'auth.log' file Dec 6, 2019 at 15:33
  • Please check your logging configuration. Perhaps another logfile is used in your environment.
    – Lambert
    Dec 6, 2019 at 15:45
  • How can I check my logging configuration? Dec 6, 2019 at 21:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .