I'm wondering if there is a method or program that can monitor SSH file transfers and send out an email when a file (incoming) has been transferred?

(The other alternative would be to at least get a notification when someone logges in via SSH, though it would be ideal if the email contained information about what file has been transferred)

Further, how can one check to see active users who are engaged in a ssh file transfer?

I understand this is a OSX question, but I thought it would be more suited to the SuperUser site. Please vote to move if im mistaken :)

  • 1
    Questions related to Mac OS X are on topic on Super User. Always were. Existence of another site with topic overlap doesn't change this. – Daniel Beck Aug 31 '12 at 4:49
  • 1
    SSH logs login, authentication and logout to the system.log (check it out in Console.app). Especially the subsystem request for sftp message might be helpful in determining what kind of SSH connection this is. Unfortunately, even increasing the LogLevel in /etc/sshd_config to DEBUG3 (highest) doesn't show file names of uploaded files, and going strictly after when sessions are opened or closed might not be too useful... – Daniel Beck Aug 31 '12 at 5:06
  • thanks for the tip! Login and logouts are a start - Thanks @Daniel – OrangeBox Sep 19 '12 at 1:35
  • You can use logwatch to do this for remote logins and system-wide file changes. I have a chron job setup to email me a logwatch report daily/weekly, but you can also generate reports right in a terminal emulator. – Breakthrough Aug 4 '13 at 12:26
  • probably should look into this: serverfault.com/questions/73319/sftp-logging-is-there-a-way – user218473 Aug 10 '13 at 11:48

In order to check which users have an active SFTP session right now, you can look for the sftp-server process. Note that the presence of the process doesn't necessarily mean they're currently transferring files.

$ ps uax | grep '[s]ftp-server'
1000     15115  0.0  0.0  12532   728 ?        Ss   14:38   0:00 /usr/lib/openssh/sftp-server

(In case you wonder, the square brackets in the pattern are used as a "hack" to hide the grep command itself from the output.)

Shell script (bash)

#!/usr/bin/env bash

pids=$(pgrep -x sftp-server)

for pid in "${pids[@]}"; do
    users+=("$(ps --no-headers -o user 15115)")

echo "Users with active SFTP sessions: ${users[*]}"

If you want to output one user per line, replace the last line with this:

echo "Users with active SFTP sessions:"
for user in "${user[@]}"; do
    echo "$user"

Alternatively, you could use the /proc filesystem instead of depending on pgrep. That's not detailed in this answer.

  • OS X's ps doesn't have --no-headers, but you can use ps -p 15115 -o user=. – Lri Dec 10 '13 at 4:19

This is an example script for sending a custom message via email.

echo "User $USER just logged in * $(date '+%d-%m-%Y %T') |
    sendmail -q -u "SSH Login" -f 'Originator <from@address.com>' \
             -t 'Your Name <your.email@domain.com>' -s smtp.server.com &

For sending email you will need the sendmail package installed. Read the man page of sendmail for more details.

You can put a script like this in the .bash_login of the desired user so that you will get an email notification whenever the person uses terminal login and the login succeeds. (SSH uses terminal login.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.