Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I run last I get something like:

user    pts/0        user.domain.provider Sat Feb 25 11:44   still logged in 
user    pts/0        user.domain.provider Thu Feb 23 16:38 - 16:39  (00:00)

But if I connect to the server with sFTP, this won't show up in this list. Are there any other logs or a different command?

share|improve this question
which package you have used to configure sftp? – Mughil Feb 25 '12 at 11:02
Hm... I don't really get your question. I use OpenSSH. – lumbric Feb 25 '12 at 11:18
up vote 2 down vote accepted

The default configuration of syslogd sends all log messages related to authentication to /var/log/auth.log, which will include openssh-server's log messages.

share|improve this answer

The last commands reads from /var/log/wtmp and its bad cousin /var/log/btmp, which according to man (man wtmp) are the login records.

Not all processes use this facility, so there may be other users logged to the system.

In the sftp case, I think that sshd does not consider scp or sftp as interactive sessions.

This was also discussed at .

share|improve this answer
Your answer and the Q&A you linked explain some details, but unfortunately don't solve my question. scp/sftp is not considered as interactive session, so there is no entry in /var/log/btmp or /var/log/wtmp. But if I want to check if a user is connected through sftp, I still don't know how to enable logging or where to find the logs. – lumbric Feb 26 '12 at 12:04
@lumbric check /var/log/auth.log – geirha Mar 1 '12 at 11:25
@geirha Oh wow, that was easy! If you convert it to an answer, I can award your answer for the bounty. – lumbric Mar 1 '12 at 14:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.