Enable SFTP logging transfer

SFTP (installed with OpenSSH) does not normally log activity. To log access and file changes, configure its Subsystem settings. SFTP logging can be configured in OpenSSH version 4.0 or later with the following steps. Edit /etc/ssh/sshd_config and find this line:

Subsystem sftp /usr/libexec/openssh/sftp-server

Change it to:

Subsystem    sftp    /usr/libexec/openssh/sftp-server -f LOCAL5 -l INFO

Restart sshd with this command. [root@Ezylinux ~]# service sshd restart Next, specify the SFTP log filename in rsyslogd or syslogd. For rsyslogd Edit /etc/rsyslogd.conf and add the following lines.

if $syslogfacility-text == 'local5' and $syslogtag contains 'sftp-server' then /var/log/sftp.log
& ~

For syslogd Edit /etc/syslog.conf and add the following lines.

#sftp logging
local5.*                        /var/log/sftpd.log