# syslog config for sftp logging



## spring_64 (Mar 26, 2017)

I'm on FreeBSD11. I changed syslog config file to log sftp actions in a file, but it doesn't work.

/etc/ssh/sshd_config


```
Subsystem       sftp    /usr/libexec/sftp-server -f LOCAL5 -l INFO
```

/etc/syslog.conf


```
local5.info                                        /var/log/sftp/sftp.log
```

Then I restart the services, but any action saved in sftp.log and it's empty.

Thank you for your help.


----------



## rotor (Mar 26, 2017)

Did you `touch /var/log/sftp/sftp.log` to initialize the file?  Also make sure the file has the correct permissions.


----------



## rotor (Mar 26, 2017)

Does the logging work outside of stfp?  

For example:

`logger -p local5.info hello world`


----------



## spring_64 (Mar 27, 2017)

rotor said:


> Did you  touch /var/log/sftp/sftp.log to initialize the file? Also make sure the file has the correct permissions.


Yes, I initialize the file and it's permission is 755.



rotor said:


> logger -p local5.info hello world


Yes, It work outside of stfp.


----------



## SirDice (Mar 27, 2017)

spring_64 said:


> Yes, I initialize the file and it's permission is 755.


Files should not be executable unless they are in fact, executables. Log files aren't.


----------



## rotor (Mar 27, 2017)

spring_64 said:


> ...Yes, It work outside of stfp.




I'm at a loss then, except for, maybe, this sftp-server(8)

"... use of *sftp-server* in a chroot configuration therefore requires that syslogd(8) establish a logging socket inside the chroot directory...."


----------



## spring_64 (Apr 5, 2017)

I tried a lot but I don't succeeded yet.
according to this post https://forums.freebsd.org/threads/52408/ I establish a logging socket inside the chroot directory, but I don't have any log. 
any idea?


----------



## GDP (Jun 2, 2017)

spring_64 said:


> I tried a lot but I don't succeeded yet.
> according to this post https://forums.freebsd.org/threads/52408/ I establish a logging socket inside the chroot directory, but I don't have any log.
> any idea?



See if this previous thread can help https://forums.freebsd.org/threads/4349/


----------

