sftp logs to be rerouted

[AbhilashPaul]

how can i reroute the log files of sftp from syslog.log file. &.I am using Hp unix 11.23 box.

[Nido · Accepted solution]

Hello Abhilash,

Check for SyslogFacility in the following link:
http://docs.hp.com/en/5992-4213/5992-4213.pdf

On my machine syslogfacility is disabled which bydefault sets to AUTH.

# grep -i syslo /opt/ssh/etc/sshd_config
#SyslogFacility AUTH


You may put entry like below in /opt/ssh/etc/sshd_config:

SysLogFacility LOCAL6


In /etc/syslog.conf add the following:
local6.notice /var/log/sftp


Restart the sshd daemon and it should log notice messages to /var/log/sftp.


Cheers!!

[TTr]

An sftp client connects to the sshd service so sftp logging is part of the overall sshd logging. You can not separate only the sftp log entires out of the syslog file, you would have to separate all sshd logging. This would include logging from ssh and scp connections. Are you willing to do that?

[TTr]

@Nido SysLogFacility LOCAL6

First you have to ensure that nothing else is set up to use the LOCAL6 facility.

Then the local6 facility must be excluded from the syslog.log loging by adding the local6.none in the syslog.log line in the syslog.conf file. Otherwise you end up with dual logging in both the syslog.log and the /var/log/sftp file.

The /var/log/sftp file is not an HP-UX standard. There is nothing wrong with using it but it would be more appropriate to use /var/adm/syslog/sshd.log

[Nido]

@TTr,I agree and Thanks!!