Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to log activity (uploads, downloads, renames, deletes) for SFTP users. If I SFTP with a normal user, it logs to /var/log/secure. If I SFTP with a rssh user, it logs that they connected, but nothing else.

In /var/log/messages it shows:

rssh[8287]: setting log facility to LOG_USER
rssh[8287]: allowing scp to all users
rssh[8287]: allowing sftp to all users
rssh[8287]: allowing rsync to all users
rssh[8287]: setting umask to 022
rssh[8287]: chrooting all users to /home/data
rssh[8287]: chroot cmd line: /usr/local/libexec/rssh_chroot_helper 2 "/usr/libexec/openssh/sftp-server -f AUTHPRIV -l VERBOSE"
rssh_chroot_helper[8287]: new session for USERNAME, UID=721
rssh_chroot_helper[8287]: user's home dir is /home/data/home/USERNAME
rssh_chroot_helper[8287]: chrooted to /home/data
rssh_chroot_helper[8287]: changing working directory to /home/USERNAME (inside jail)


SyslogFacility AUTHPRIV LogLevel DEBUG Subsystem       sftp   
/usr/libexec/openssh/sftp-server -f AUTHPRIV -l VERBOSE



I've tried to find a solution online, but nothing seems to work. I tried doing the following with a link set to /dev/log and /var/log/secure, but neither worked.


SYSLOGD_OPTIONS="-m 0 -a /home/data/home/USERNAME/dev/log"
share|improve this question

You must log in to answer this question.

Browse other questions tagged .