SFTP not logging to /var/log/sftp.log
Clash Royale CLAN TAG#URR8PPP
up vote
0
down vote
favorite
This article (Setting up logging for chroot users) is the only one that has helped me to get logging working for chroot'd sftp users, so huge thanks for that!
However, for some reason, my logs messages are all going to /var/log/secure and not to /var/log/sftp.log even though my /etc/rsyslog.d/sftplogging.conf file looks like this:
#create socket in chroot user's dev floder
$AddUnixListenSocket /sftproot/files/customer/live/customerlive/dev/log
$AddUnixListenSocket /sftproot/files/customer/test/customertest/dev/log
$AddUnixListenSocket /sftproot/files/customer/live/dev/log
$AddUnixListenSocket /sftproot/files/customer/test/dev/log
#log internal-sftp in a seperate file
:programname, isequal, "internal-sftp" -/var/log/sftp.log
:programname, isequal, "internal-sftp" ~
Does anyone have any ideas why this isn't logging to /var/log/sftp.log please?
chroot sftp rsyslog
asked Jul 11 at 8:31
Bryn Ellis
11
add a comment |Â
up vote
0
down vote
favorite
This article (Setting up logging for chroot users) is the only one that has helped me to get logging working for chroot'd sftp users, so huge thanks for that!
However, for some reason, my logs messages are all going to /var/log/secure and not to /var/log/sftp.log even though my /etc/rsyslog.d/sftplogging.conf file looks like this:
#create socket in chroot user's dev floder
$AddUnixListenSocket /sftproot/files/customer/live/customerlive/dev/log
$AddUnixListenSocket /sftproot/files/customer/test/customertest/dev/log
$AddUnixListenSocket /sftproot/files/customer/live/dev/log
$AddUnixListenSocket /sftproot/files/customer/test/dev/log
#log internal-sftp in a seperate file
:programname, isequal, "internal-sftp" -/var/log/sftp.log
:programname, isequal, "internal-sftp" ~
Does anyone have any ideas why this isn't logging to /var/log/sftp.log please?
chroot sftp rsyslog
asked Jul 11 at 8:31
Bryn Ellis
11
did you create socket ? what is result fromfile /sftproot/files/customer/test/dev/log?
– Archemar
Jul 11 at 8:47
Thanks for replying. The result is: /sftproot/files/customer/test/dev/log: socket
– Bryn Ellis
Jul 16 at 14:54
add a comment |Â
up vote
0
down vote
favorite
up vote
0
down vote
favorite
This article (Setting up logging for chroot users) is the only one that has helped me to get logging working for chroot'd sftp users, so huge thanks for that!
However, for some reason, my logs messages are all going to /var/log/secure and not to /var/log/sftp.log even though my /etc/rsyslog.d/sftplogging.conf file looks like this:
#create socket in chroot user's dev floder
$AddUnixListenSocket /sftproot/files/customer/live/customerlive/dev/log
$AddUnixListenSocket /sftproot/files/customer/test/customertest/dev/log
$AddUnixListenSocket /sftproot/files/customer/live/dev/log
$AddUnixListenSocket /sftproot/files/customer/test/dev/log
#log internal-sftp in a seperate file
:programname, isequal, "internal-sftp" -/var/log/sftp.log
:programname, isequal, "internal-sftp" ~
Does anyone have any ideas why this isn't logging to /var/log/sftp.log please?
chroot sftp rsyslog
asked Jul 11 at 8:31
Bryn Ellis
11
This article (Setting up logging for chroot users) is the only one that has helped me to get logging working for chroot'd sftp users, so huge thanks for that!
However, for some reason, my logs messages are all going to /var/log/secure and not to /var/log/sftp.log even though my /etc/rsyslog.d/sftplogging.conf file looks like this:
#create socket in chroot user's dev floder
$AddUnixListenSocket /sftproot/files/customer/live/customerlive/dev/log
$AddUnixListenSocket /sftproot/files/customer/test/customertest/dev/log
$AddUnixListenSocket /sftproot/files/customer/live/dev/log
$AddUnixListenSocket /sftproot/files/customer/test/dev/log
#log internal-sftp in a seperate file
:programname, isequal, "internal-sftp" -/var/log/sftp.log
:programname, isequal, "internal-sftp" ~
Does anyone have any ideas why this isn't logging to /var/log/sftp.log please?
chroot sftp rsyslog
asked Jul 11 at 8:31
Bryn Ellis
11
asked Jul 11 at 8:31
Bryn Ellis
11
asked Jul 11 at 8:31
Bryn Ellis
11
asked Jul 11 at 8:31
Bryn Ellis
11
11
did you create socket ? what is result fromfile /sftproot/files/customer/test/dev/log?
– Archemar
Jul 11 at 8:47
Thanks for replying. The result is: /sftproot/files/customer/test/dev/log: socket
– Bryn Ellis
Jul 16 at 14:54
add a comment |Â
did you create socket ? what is result fromfile /sftproot/files/customer/test/dev/log?
– Archemar
Jul 11 at 8:47
Thanks for replying. The result is: /sftproot/files/customer/test/dev/log: socket
– Bryn Ellis
Jul 16 at 14:54
did you create socket ? what is result from
file /sftproot/files/customer/test/dev/log ?– Archemar
Jul 11 at 8:47
did you create socket ? what is result from
file /sftproot/files/customer/test/dev/log ?– Archemar
Jul 11 at 8:47
Thanks for replying. The result is: /sftproot/files/customer/test/dev/log: socket
– Bryn Ellis
Jul 16 at 14:54
Thanks for replying. The result is: /sftproot/files/customer/test/dev/log: socket
– Bryn Ellis
Jul 16 at 14:54
add a comment |Â
1 Answer
1
active
oldest
votes
up vote
0
down vote
My configuration is a bit different, in my /etc/ssh/sshd_conf I specify a local where to send the logs:
Subsystem sftp internal-sftp -f LOCAL4 -l VERBOSE
Then I refer that local in my rsyslog.conf with
local4.* -/var/log/sshd.log
That will log my user's acctions in /var/log/sshd.log.
answered Jul 11 at 9:20
YoMismo
2,8931619
Thanks for replying. Is your user chrooted? I've always been a bit confused with the whole LOCAL3,4,5,6... thing to be honest! I don't actually know what LOCAL4 is or means which is why I steered away from that solution.
– Bryn Ellis
Jul 16 at 14:56
Yes they are, I have plenty of them. If I'm not mistaken you can choose a local number which is not being used for logging anything else and take it for your logs. In my case it was 4.
– YoMismo
Jul 16 at 15:02
add a comment |Â
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
0
down vote
My configuration is a bit different, in my /etc/ssh/sshd_conf I specify a local where to send the logs:
Subsystem sftp internal-sftp -f LOCAL4 -l VERBOSE
Then I refer that local in my rsyslog.conf with
local4.* -/var/log/sshd.log
That will log my user's acctions in /var/log/sshd.log.
answered Jul 11 at 9:20
YoMismo
2,8931619
Thanks for replying. Is your user chrooted? I've always been a bit confused with the whole LOCAL3,4,5,6... thing to be honest! I don't actually know what LOCAL4 is or means which is why I steered away from that solution.
– Bryn Ellis
Jul 16 at 14:56
Yes they are, I have plenty of them. If I'm not mistaken you can choose a local number which is not being used for logging anything else and take it for your logs. In my case it was 4.
– YoMismo
Jul 16 at 15:02
add a comment |Â
up vote
0
down vote
My configuration is a bit different, in my /etc/ssh/sshd_conf I specify a local where to send the logs:
Subsystem sftp internal-sftp -f LOCAL4 -l VERBOSE
Then I refer that local in my rsyslog.conf with
local4.* -/var/log/sshd.log
That will log my user's acctions in /var/log/sshd.log.
answered Jul 11 at 9:20
YoMismo
2,8931619
Thanks for replying. Is your user chrooted? I've always been a bit confused with the whole LOCAL3,4,5,6... thing to be honest! I don't actually know what LOCAL4 is or means which is why I steered away from that solution.
– Bryn Ellis
Jul 16 at 14:56
Yes they are, I have plenty of them. If I'm not mistaken you can choose a local number which is not being used for logging anything else and take it for your logs. In my case it was 4.
– YoMismo
Jul 16 at 15:02
add a comment |Â
up vote
0
down vote
up vote
0
down vote
My configuration is a bit different, in my /etc/ssh/sshd_conf I specify a local where to send the logs:
Subsystem sftp internal-sftp -f LOCAL4 -l VERBOSE
Then I refer that local in my rsyslog.conf with
local4.* -/var/log/sshd.log
That will log my user's acctions in /var/log/sshd.log.
answered Jul 11 at 9:20
YoMismo
2,8931619
My configuration is a bit different, in my /etc/ssh/sshd_conf I specify a local where to send the logs:
Subsystem sftp internal-sftp -f LOCAL4 -l VERBOSE
Then I refer that local in my rsyslog.conf with
local4.* -/var/log/sshd.log
That will log my user's acctions in /var/log/sshd.log.
answered Jul 11 at 9:20
YoMismo
2,8931619
answered Jul 11 at 9:20
YoMismo
2,8931619
answered Jul 11 at 9:20
YoMismo
2,8931619
answered Jul 11 at 9:20
YoMismo
2,8931619
2,8931619
Thanks for replying. Is your user chrooted? I've always been a bit confused with the whole LOCAL3,4,5,6... thing to be honest! I don't actually know what LOCAL4 is or means which is why I steered away from that solution.
– Bryn Ellis
Jul 16 at 14:56
Yes they are, I have plenty of them. If I'm not mistaken you can choose a local number which is not being used for logging anything else and take it for your logs. In my case it was 4.
– YoMismo
Jul 16 at 15:02
add a comment |Â
Thanks for replying. Is your user chrooted? I've always been a bit confused with the whole LOCAL3,4,5,6... thing to be honest! I don't actually know what LOCAL4 is or means which is why I steered away from that solution.
– Bryn Ellis
Jul 16 at 14:56
Yes they are, I have plenty of them. If I'm not mistaken you can choose a local number which is not being used for logging anything else and take it for your logs. In my case it was 4.
– YoMismo
Jul 16 at 15:02
Thanks for replying. Is your user chrooted? I've always been a bit confused with the whole LOCAL3,4,5,6... thing to be honest! I don't actually know what LOCAL4 is or means which is why I steered away from that solution.
– Bryn Ellis
Jul 16 at 14:56
Thanks for replying. Is your user chrooted? I've always been a bit confused with the whole LOCAL3,4,5,6... thing to be honest! I don't actually know what LOCAL4 is or means which is why I steered away from that solution.
– Bryn Ellis
Jul 16 at 14:56
Yes they are, I have plenty of them. If I'm not mistaken you can choose a local number which is not being used for logging anything else and take it for your logs. In my case it was 4.
– YoMismo
Jul 16 at 15:02
Yes they are, I have plenty of them. If I'm not mistaken you can choose a local number which is not being used for logging anything else and take it for your logs. In my case it was 4.
– YoMismo
Jul 16 at 15:02
add a comment |Â
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f454640%2fsftp-not-logging-to-var-log-sftp-log%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
did you create socket ? what is result from
file /sftproot/files/customer/test/dev/log?– Archemar
Jul 11 at 8:47
Thanks for replying. The result is: /sftproot/files/customer/test/dev/log: socket
– Bryn Ellis
Jul 16 at 14:54