topic Re: SFTP Logging in Operating System - HP-UX

SFTP Logging

AZayed — Sun, 26 Dec 2010 10:03:20 GMT

Dears,
Good day,

I was able to redirect all SFTP connection log to /var/adm/syslog/xferlog but it's giving me a lot of unnecessary information like connection open/close, changing directory ...

I only need information like the one FTP write. e.g. the username, IP address, action ( delete , rename , add ) with the file name.

So, can I do this ? because the file size is growing fast.

This is the parameters for SFTP :

sftp-server -f LOCAL0 -l INFO

Regards,

Re: SFTP Logging

kemo — Sun, 26 Dec 2010 11:38:46 GMT

hola

have a look at this thread

http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1159249

thanks

Re: SFTP Logging

AZayed — Mon, 27 Dec 2010 06:32:04 GMT

Thanks but I couldn't find the answer I looking for.

Re: SFTP Logging

Matti_Kurkela — Mon, 27 Dec 2010 11:28:23 GMT

SFTP does not use the traditional xferlog format FTP uses.

You may have to find or write a script to post-process the SFTP connection log, to discard the parts useless to you. If you wish, you could also convert the log to the xferlog format.

I could not find such a script quickly with Google. Perhaps nobody has done such a script before, or perhaps I didn't use the right keywords?

MK

Re: SFTP Logging

AZayed — Mon, 27 Dec 2010 16:19:48 GMT

Hi Matti,
How are you doing?

I liked this idea, do you know how to do it?

If you wish, you could also convert the log to the xferlog format.

Thanks

Re: SFTP Logging

James R. Ferguson — Mon, 27 Dec 2010 16:56:07 GMT

Hi:

The format of the 'xferlog' is documented in the manpages: 'xferlog(5)'.

Regards!

...JRF...

Re: SFTP Logging

AZayed — Mon, 27 Dec 2010 18:44:09 GMT

Hi JRF,

Hope you doing well.

We need to turn off FTP and start using SFTP with logging. Now, every FTP session write single line to xferlog but SFTP writes a lot of line for single connection. I need to reduce these amount of lines.

Thanks

Re: SFTP Logging

James R. Ferguson — Mon, 27 Dec 2010 20:40:36 GMT

Hi (again):

> every FTP session write single line to xferlog but SFTP writes a lot of line for single connection. I need to reduce these amount of lines.

And Matti already suggested that you might read the SFTP log entries and reformat them into the form expected for 'xferlog'. My comment was that that format is documented in the manpages.

If you plan to turn *off* FTP altogether, I don't necessarily see any value to reformatting its log information into the 'xferlog' format. You need to first define what information you would want logged and if it is worth reducing the raw log entries into a more compact form. You need to define, too, what information you might want to gain from the log (raw or refined).

Regards!

...JRF...