I'm using Ubuntu Server 16.04.4 LTS to set up a SFTP server via openssh-sftp-server 1:7.2p2-4ubuntu2.8 from my Server I would like to log user activity (change dir, upload/download file etc). So, I am using the below configuration. But, I don't see any information getting logged on /var/log/sftp.log

I have tried a few tutorials on this, but cant seem to get it to work

I am not sure what I am missing.

root:root /var/log/sftp.log root:root /cbop


$AddUnixListenSocket /cbop/dev/log
$AddUnixListenSocket /home/occusr/dev/log
# create additional sockets for the sftp chrooted users
input(type="imuxsock" Socket="/cbop" CreatePath="on")
input(type="imuxsock" Socket="/home/occusr/dev/log" CreatePath="on")

# log internal-sftp activity to sftp.log
if $programname == 'internal-sftp' then /var/log/sftp.log
& stop

local0.* /var/log/sftp.log
#LOCAL0.* /var/log/sftp.log
# Report logins and logoffs
#:syslogtag,startswith,"sftp-server" /var/log/sftp.log


UsePrivilegeSeparation no
Subsystem       sftp    internal-sftp -f LOCAL0 -l DEBUG3

Match Group sftponly User *,!ops-user-grp
        ChrootDirectory /cbop
        AllowTcpForwarding no
        X11Forwarding no
        ForceCommand internal-sftp -f LOCAL0 -l DEBUG3
  • Try specifying only the local0.* /var/log/sftp.log statement, and make sure to restart both the SSH & rsyslogd daemons. Then see if you're getting any log output.
    – Haxiel
    Commented Apr 15, 2020 at 5:58
  • tired that buddy, but still same
    – BalaB
    Commented Apr 15, 2020 at 8:47
  • How to check chroot jail ?
    – BalaB
    Commented Apr 15, 2020 at 8:48

1 Answer 1


Please cross check the permission ( chown and chmod ) /var/log/syslog apply the same to /var/log/sftp.log.

Also check SyslogFacility AUTHPRIV in sshd_config file. you are almost near to see the logs. take a look on 60-sftp-server.conf

which should be holding entry like Auth,Authpriv.*

refer : https://www.the-art-of-web.com/system/rsyslog-config/

  • Thanks a lot it worked charmingly
    – BalaB
    Commented Apr 24, 2020 at 0:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .