I haven't been able to figure out how to log user activity for my SFTP on my CentOS 7 server. I have configured rsyslog to send logs to my Syslog Server. I would like to do the same with user activity.

Thank you!

  • What exactly are you wanting to log, the addition/removal of files?
    – cutrightjm
    Commented Aug 26, 2022 at 5:26

1 Answer 1


Please check this first: https://linux.die.net/man/8/sftp-server

From here you can choose what is available and what is the perfect option according to your demand; logging "user activities".

I guess the:


Please follow the instructions below and modify it according to your needs.


How to configure sftp to log the name, location, and size of the transferred files ?


Configure the sshd_config file to log information to syslog.

#vi /etc/ssh/sshd_config

Locate the following line:

Subsystem sftp /usr/sbin/sftp-server

Add the following parameters "-l INFO -f AUTH" at the end:

Subsystem sftp /usr/sbin/sftp-server -l INFO -f AUTH

Save the /etc/ssh/sshd_config file.

Configure syslog to record information from sftp-server.

# vi /etc/syslog.conf

Add the following line in syslog.conf

auth.info /tmp/sftp.log

Save the file /etc/syslog.conf, create the log file, and refresh syslogd.

# touch /tmp/sftp.log
# refresh -s syslogd

Restart sshd daemon.

# stopsrc -s sshd
# startsrc -s sshd

NOTE: While stopping and starting sshd, users will not be able create new connections. Existing connections will not be disconnected.

Test the following from an sftp client.

# sftp user@<server-name>
password: <Enter Password>
<sftp>cd /
<sftp>put motd

In the syslog, you should see logged information similar to the following output, which includes the file name and size.

Oct 8 11:29:07 greybso auth|security:info sftp-server[372922]: open "/motd" flags WRITE,CREATE,TRUNCATE mode 0666

Oct 8 11:29:07 greybso auth|security:info sftp-server[372922]: close "/motd" bytes read 0 written 880

Source: https://www.ibm.com/support/pages/configuring-sftp-log-filename-location-and-size-transfers

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .