cancel
Showing results for 
Search instead for 
Did you mean: 

sftp logs to be rerouted

SOLVED
Go to solution
AbhilashPaul
Advisor

sftp logs to be rerouted

how can i reroute the log files of sftp from syslog.log file. &.I am using Hp unix 11.23 box.
4 REPLIES
Nido
Trusted Contributor
Solution

Re: sftp logs to be rerouted

Hello Abhilash,

Check for SyslogFacility in the following link:
http://docs.hp.com/en/5992-4213/5992-4213.pdf

On my machine syslogfacility is disabled which bydefault sets to AUTH.

# grep -i syslo /opt/ssh/etc/sshd_config
#SyslogFacility AUTH


You may put entry like below in /opt/ssh/etc/sshd_config:

SysLogFacility LOCAL6


In /etc/syslog.conf add the following:
local6.notice /var/log/sftp


Restart the sshd daemon and it should log notice messages to /var/log/sftp.


Cheers!!
" Let Villagers Be Happy!! "
TTr
Honored Contributor

Re: sftp logs to be rerouted

An sftp client connects to the sshd service so sftp logging is part of the overall sshd logging. You can not separate only the sftp log entires out of the syslog file, you would have to separate all sshd logging. This would include logging from ssh and scp connections. Are you willing to do that?
TTr
Honored Contributor

Re: sftp logs to be rerouted

@Nido SysLogFacility LOCAL6

First you have to ensure that nothing else is set up to use the LOCAL6 facility.

Then the local6 facility must be excluded from the syslog.log loging by adding the local6.none in the syslog.log line in the syslog.conf file. Otherwise you end up with dual logging in both the syslog.log and the /var/log/sftp file.

The /var/log/sftp file is not an HP-UX standard. There is nothing wrong with using it but it would be more appropriate to use /var/adm/syslog/sshd.log
Nido
Trusted Contributor

Re: sftp logs to be rerouted

@TTr,I agree and Thanks!!
" Let Villagers Be Happy!! "