SFTP not logging to /var/log/sftp.log
This article (Setting up logging for chroot users) is the only one that has helped me to get logging working for chroot'd sftp users, so huge thanks for that!
However, for some reason, my logs messages are all going to /var/log/secure and not to /var/log/sftp.log even though my /etc/rsyslog.d/sftplogging.conf file looks like this:
#create socket in chroot user's dev floder
$AddUnixListenSocket /sftproot/files/customer/live/customerlive/dev/log
$AddUnixListenSocket /sftproot/files/customer/test/customertest/dev/log
$AddUnixListenSocket /sftproot/files/customer/live/dev/log
$AddUnixListenSocket /sftproot/files/customer/test/dev/log
#log internal-sftp in a seperate file
:programname, isequal, "internal-sftp" -/var/log/sftp.log
:programname, isequal, "internal-sftp" ~
Does anyone have any ideas why this isn't logging to /var/log/sftp.log please?
chroot sftp rsyslog
asked Jul 11 '18 at 8:31
Bryn EllisBryn Ellis
11
bumped to the homepage by Community♦ 2 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
add a comment |
This article (Setting up logging for chroot users) is the only one that has helped me to get logging working for chroot'd sftp users, so huge thanks for that!
However, for some reason, my logs messages are all going to /var/log/secure and not to /var/log/sftp.log even though my /etc/rsyslog.d/sftplogging.conf file looks like this:
#create socket in chroot user's dev floder
$AddUnixListenSocket /sftproot/files/customer/live/customerlive/dev/log
$AddUnixListenSocket /sftproot/files/customer/test/customertest/dev/log
$AddUnixListenSocket /sftproot/files/customer/live/dev/log
$AddUnixListenSocket /sftproot/files/customer/test/dev/log
#log internal-sftp in a seperate file
:programname, isequal, "internal-sftp" -/var/log/sftp.log
:programname, isequal, "internal-sftp" ~
Does anyone have any ideas why this isn't logging to /var/log/sftp.log please?
chroot sftp rsyslog
asked Jul 11 '18 at 8:31
Bryn EllisBryn Ellis
11
bumped to the homepage by Community♦ 2 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
did you create socket ? what is result fromfile /sftproot/files/customer/test/dev/log?
– Archemar
Jul 11 '18 at 8:47
Thanks for replying. The result is: /sftproot/files/customer/test/dev/log: socket
– Bryn Ellis
Jul 16 '18 at 14:54
add a comment |
This article (Setting up logging for chroot users) is the only one that has helped me to get logging working for chroot'd sftp users, so huge thanks for that!
However, for some reason, my logs messages are all going to /var/log/secure and not to /var/log/sftp.log even though my /etc/rsyslog.d/sftplogging.conf file looks like this:
#create socket in chroot user's dev floder
$AddUnixListenSocket /sftproot/files/customer/live/customerlive/dev/log
$AddUnixListenSocket /sftproot/files/customer/test/customertest/dev/log
$AddUnixListenSocket /sftproot/files/customer/live/dev/log
$AddUnixListenSocket /sftproot/files/customer/test/dev/log
#log internal-sftp in a seperate file
:programname, isequal, "internal-sftp" -/var/log/sftp.log
:programname, isequal, "internal-sftp" ~
Does anyone have any ideas why this isn't logging to /var/log/sftp.log please?
chroot sftp rsyslog
asked Jul 11 '18 at 8:31
Bryn EllisBryn Ellis
11
This article (Setting up logging for chroot users) is the only one that has helped me to get logging working for chroot'd sftp users, so huge thanks for that!
However, for some reason, my logs messages are all going to /var/log/secure and not to /var/log/sftp.log even though my /etc/rsyslog.d/sftplogging.conf file looks like this:
#create socket in chroot user's dev floder
$AddUnixListenSocket /sftproot/files/customer/live/customerlive/dev/log
$AddUnixListenSocket /sftproot/files/customer/test/customertest/dev/log
$AddUnixListenSocket /sftproot/files/customer/live/dev/log
$AddUnixListenSocket /sftproot/files/customer/test/dev/log
#log internal-sftp in a seperate file
:programname, isequal, "internal-sftp" -/var/log/sftp.log
:programname, isequal, "internal-sftp" ~
Does anyone have any ideas why this isn't logging to /var/log/sftp.log please?
chroot sftp rsyslog
chroot sftp rsyslog
asked Jul 11 '18 at 8:31
Bryn EllisBryn Ellis
11
asked Jul 11 '18 at 8:31
Bryn EllisBryn Ellis
11
asked Jul 11 '18 at 8:31
Bryn EllisBryn Ellis
11
asked Jul 11 '18 at 8:31
Bryn EllisBryn Ellis
11
asked Jul 11 '18 at 8:31
Bryn EllisBryn Ellis
11
11
bumped to the homepage by Community♦ 2 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
bumped to the homepage by Community♦ 2 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
did you create socket ? what is result fromfile /sftproot/files/customer/test/dev/log?
– Archemar
Jul 11 '18 at 8:47
Thanks for replying. The result is: /sftproot/files/customer/test/dev/log: socket
– Bryn Ellis
Jul 16 '18 at 14:54
add a comment |
did you create socket ? what is result fromfile /sftproot/files/customer/test/dev/log?
– Archemar
Jul 11 '18 at 8:47
Thanks for replying. The result is: /sftproot/files/customer/test/dev/log: socket
– Bryn Ellis
Jul 16 '18 at 14:54
did you create socket ? what is result from
file /sftproot/files/customer/test/dev/log ?– Archemar
Jul 11 '18 at 8:47
did you create socket ? what is result from
file /sftproot/files/customer/test/dev/log ?– Archemar
Jul 11 '18 at 8:47
Thanks for replying. The result is: /sftproot/files/customer/test/dev/log: socket
– Bryn Ellis
Jul 16 '18 at 14:54
Thanks for replying. The result is: /sftproot/files/customer/test/dev/log: socket
– Bryn Ellis
Jul 16 '18 at 14:54
add a comment |
1 Answer
1
active
oldest
votes
My configuration is a bit different, in my /etc/ssh/sshd_conf I specify a local where to send the logs:
Subsystem sftp internal-sftp -f LOCAL4 -l VERBOSE
Then I refer that local in my rsyslog.conf with
local4.* -/var/log/sshd.log
That will log my user's acctions in /var/log/sshd.log.
answered Jul 11 '18 at 9:20
YoMismoYoMismo
3,0861926
Thanks for replying. Is your user chrooted? I've always been a bit confused with the whole LOCAL3,4,5,6... thing to be honest! I don't actually know what LOCAL4 is or means which is why I steered away from that solution.
– Bryn Ellis
Jul 16 '18 at 14:56
Yes they are, I have plenty of them. If I'm not mistaken you can choose a local number which is not being used for logging anything else and take it for your logs. In my case it was 4.
– YoMismo
Jul 16 '18 at 15:02
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f454640%2fsftp-not-logging-to-var-log-sftp-log%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
My configuration is a bit different, in my /etc/ssh/sshd_conf I specify a local where to send the logs:
Subsystem sftp internal-sftp -f LOCAL4 -l VERBOSE
Then I refer that local in my rsyslog.conf with
local4.* -/var/log/sshd.log
That will log my user's acctions in /var/log/sshd.log.
answered Jul 11 '18 at 9:20
YoMismoYoMismo
3,0861926
Thanks for replying. Is your user chrooted? I've always been a bit confused with the whole LOCAL3,4,5,6... thing to be honest! I don't actually know what LOCAL4 is or means which is why I steered away from that solution.
– Bryn Ellis
Jul 16 '18 at 14:56
Yes they are, I have plenty of them. If I'm not mistaken you can choose a local number which is not being used for logging anything else and take it for your logs. In my case it was 4.
– YoMismo
Jul 16 '18 at 15:02
add a comment |
My configuration is a bit different, in my /etc/ssh/sshd_conf I specify a local where to send the logs:
Subsystem sftp internal-sftp -f LOCAL4 -l VERBOSE
Then I refer that local in my rsyslog.conf with
local4.* -/var/log/sshd.log
That will log my user's acctions in /var/log/sshd.log.
answered Jul 11 '18 at 9:20
YoMismoYoMismo
3,0861926
Thanks for replying. Is your user chrooted? I've always been a bit confused with the whole LOCAL3,4,5,6... thing to be honest! I don't actually know what LOCAL4 is or means which is why I steered away from that solution.
– Bryn Ellis
Jul 16 '18 at 14:56
Yes they are, I have plenty of them. If I'm not mistaken you can choose a local number which is not being used for logging anything else and take it for your logs. In my case it was 4.
– YoMismo
Jul 16 '18 at 15:02
add a comment |
My configuration is a bit different, in my /etc/ssh/sshd_conf I specify a local where to send the logs:
Subsystem sftp internal-sftp -f LOCAL4 -l VERBOSE
Then I refer that local in my rsyslog.conf with
local4.* -/var/log/sshd.log
That will log my user's acctions in /var/log/sshd.log.
answered Jul 11 '18 at 9:20
YoMismoYoMismo
3,0861926
My configuration is a bit different, in my /etc/ssh/sshd_conf I specify a local where to send the logs:
Subsystem sftp internal-sftp -f LOCAL4 -l VERBOSE
Then I refer that local in my rsyslog.conf with
local4.* -/var/log/sshd.log
That will log my user's acctions in /var/log/sshd.log.
answered Jul 11 '18 at 9:20
YoMismoYoMismo
3,0861926
answered Jul 11 '18 at 9:20
YoMismoYoMismo
3,0861926
answered Jul 11 '18 at 9:20
YoMismoYoMismo
3,0861926
answered Jul 11 '18 at 9:20
YoMismoYoMismo
3,0861926
3,0861926
Thanks for replying. Is your user chrooted? I've always been a bit confused with the whole LOCAL3,4,5,6... thing to be honest! I don't actually know what LOCAL4 is or means which is why I steered away from that solution.
– Bryn Ellis
Jul 16 '18 at 14:56
Yes they are, I have plenty of them. If I'm not mistaken you can choose a local number which is not being used for logging anything else and take it for your logs. In my case it was 4.
– YoMismo
Jul 16 '18 at 15:02
add a comment |
Thanks for replying. Is your user chrooted? I've always been a bit confused with the whole LOCAL3,4,5,6... thing to be honest! I don't actually know what LOCAL4 is or means which is why I steered away from that solution.
– Bryn Ellis
Jul 16 '18 at 14:56
Yes they are, I have plenty of them. If I'm not mistaken you can choose a local number which is not being used for logging anything else and take it for your logs. In my case it was 4.
– YoMismo
Jul 16 '18 at 15:02
Thanks for replying. Is your user chrooted? I've always been a bit confused with the whole LOCAL3,4,5,6... thing to be honest! I don't actually know what LOCAL4 is or means which is why I steered away from that solution.
– Bryn Ellis
Jul 16 '18 at 14:56
Thanks for replying. Is your user chrooted? I've always been a bit confused with the whole LOCAL3,4,5,6... thing to be honest! I don't actually know what LOCAL4 is or means which is why I steered away from that solution.
– Bryn Ellis
Jul 16 '18 at 14:56
Yes they are, I have plenty of them. If I'm not mistaken you can choose a local number which is not being used for logging anything else and take it for your logs. In my case it was 4.
– YoMismo
Jul 16 '18 at 15:02
Yes they are, I have plenty of them. If I'm not mistaken you can choose a local number which is not being used for logging anything else and take it for your logs. In my case it was 4.
– YoMismo
Jul 16 '18 at 15:02
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f454640%2fsftp-not-logging-to-var-log-sftp-log%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
did you create socket ? what is result from
file /sftproot/files/customer/test/dev/log?– Archemar
Jul 11 '18 at 8:47
Thanks for replying. The result is: /sftproot/files/customer/test/dev/log: socket
– Bryn Ellis
Jul 16 '18 at 14:54