Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to log activity (uploads, downloads, renames, deletes) for SFTP users. If I SFTP with a normal user, it logs to /var/log/secure. If I SFTP with a rssh user, it logs that they connected, but nothing else.

In /var/log/messages it shows:

rssh[8287]: setting log facility to LOG_USER
rssh[8287]: allowing scp to all users
rssh[8287]: allowing sftp to all users
rssh[8287]: allowing rsync to all users
rssh[8287]: setting umask to 022
rssh[8287]: chrooting all users to /home/data
rssh[8287]: chroot cmd line: /usr/local/libexec/rssh_chroot_helper 2 "/usr/libexec/openssh/sftp-server -f AUTHPRIV -l VERBOSE"
rssh_chroot_helper[8287]: new session for USERNAME, UID=721
rssh_chroot_helper[8287]: user's home dir is /home/data/home/USERNAME
rssh_chroot_helper[8287]: chrooted to /home/data
rssh_chroot_helper[8287]: changing working directory to /home/USERNAME (inside jail)

/etc/ssh/sshd_config

SyslogFacility AUTHPRIV LogLevel DEBUG Subsystem       sftp   
/usr/libexec/openssh/sftp-server -f AUTHPRIV -l VERBOSE

/etc/syslog.conf

authpriv.*                                             
/var/log/secure

I've tried to find a solution online, but nothing seems to work. I tried doing the following with a link set to /dev/log and /var/log/secure, but neither worked.

/etc/sysconfig/syslog

SYSLOGD_OPTIONS="-m 0 -a /home/data/home/USERNAME/dev/log"
share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.