I'm using Ubuntu Server 16.04.4 LTS to set up a SFTP server via openssh-sftp-server 1:7.2p2-4ubuntu2.8 from my Server I would like to log user activity (change dir, upload/download file etc). So, I am using the below configuration. But, I don't see any information getting logged on /var/log/sftp.log

I have tried a few tutorials on this, but cant seem to get it to work

I am not sure what I am missing.

root:root /var/log/sftp.log root:root /cbop


$AddUnixListenSocket /cbop/dev/log
$AddUnixListenSocket /home/occusr/dev/log
# create additional sockets for the sftp chrooted users
input(type="imuxsock" Socket="/cbop" CreatePath="on")
input(type="imuxsock" Socket="/home/occusr/dev/log" CreatePath="on")

# log internal-sftp activity to sftp.log
if $programname == 'internal-sftp' then /var/log/sftp.log
& stop

local0.* /var/log/sftp.log
#LOCAL0.* /var/log/sftp.log
# Report logins and logoffs
#:syslogtag,startswith,"sftp-server" /var/log/sftp.log


UsePrivilegeSeparation no
Subsystem       sftp    internal-sftp -f LOCAL0 -l DEBUG3

Match Group sftponly User *,!ops-user-grp
        ChrootDirectory /cbop
        AllowTcpForwarding no
        X11Forwarding no
        ForceCommand internal-sftp -f LOCAL0 -l DEBUG3
  • Try specifying only the local0.* /var/log/sftp.log statement, and make sure to restart both the SSH & rsyslogd daemons. Then see if you're getting any log output.
    – Haxiel
    Apr 15, 2020 at 5:58
  • tired that buddy, but still same
    – BalaB
    Apr 15, 2020 at 8:47
  • How to check chroot jail ?
    – BalaB
    Apr 15, 2020 at 8:48

1 Answer 1


Please cross check the permission ( chown and chmod ) /var/log/syslog apply the same to /var/log/sftp.log.

Also check SyslogFacility AUTHPRIV in sshd_config file. you are almost near to see the logs. take a look on 60-sftp-server.conf

which should be holding entry like Auth,Authpriv.*

refer : https://www.the-art-of-web.com/system/rsyslog-config/

  • Thanks a lot it worked charmingly
    – BalaB
    Apr 24, 2020 at 0:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.