0

Basically, I want to log each and every file which is sent or received via SCP on the server.

Let say a user does a SCP from Server-1 to Server-2. I figured out the way to get logs on senders side, but how to get what is been transferred on the receiver's side?

I want the logs on the receiver's side containing the names of the files which are transferred to it via SCP.

Also to get logs on senders side I am using my bash script which first save the filename to a log file and then use SCP to transfer it. Is there any better approach to do so.

Thanks in advance for any suggestion.

0

You can try replacing the scp command on the server by a modified version that does what you need. scp is a very simple program and adding some logging code to it shouldn't be a daunting task.

0

You're probably using the OpenSSH software package. The OpenSSH scp utility doesn't log anything. It supports debugging output for the underlying SSH session, but that won't log the actual file transfers which are taking place.

Similarly, the OpenSSH server can be set to log detail about what it's doing, and it can be set to log the fact that a user connected and ran scp, but it won't log the actual file transfers which are taking place.

If you can't get these users to use SFTP instead, there are three approaches available to you:

  1. Investigate alternative (in other words, commercial) SSH/SFTP/SCP servers. They should generally support logging file transfers.

  2. Replace the scp utility on the server with one that logs the data you want. OpenSSH is open source. Someone who knows how to program in C for Unix could download the source and modify it.

  3. Replace the scp utility with a "wrapper" that launches the original scp program and monitors what it does. There are debugging tools for Unix which can monitor what another process is doing.

I needed to log scp transfers once, and I used the third approach. I wrote a Perl script which launched the original scp program under strace. Strace would output the names of files being opened and closed by the scp process. The Perl script parsed the strace output and figured out what files were being transferred.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.