When I run last I get something like:

user    pts/0        user.domain.provider Sat Feb 25 11:44   still logged in 
user    pts/0        user.domain.provider Thu Feb 23 16:38 - 16:39  (00:00)

But if I connect to the server with sFTP, this won't show up in this list. Are there any other logs or a different command?

  • which package you have used to configure sftp? – Mughil Feb 25 '12 at 11:02
  • 1
    Hm... I don't really get your question. I use OpenSSH. – lumbric Feb 25 '12 at 11:18

The default configuration of syslogd sends all log messages related to authentication to /var/log/auth.log, which will include openssh-server's log messages.


The last commands reads from /var/log/wtmp and its bad cousin /var/log/btmp, which according to man (man wtmp) are the login records.

Not all processes use this facility, so there may be other users logged to the system.

In the sftp case, I think that sshd does not consider scp or sftp as interactive sessions.

This was also discussed at https://unix.stackexchange.com/questions/20070/user-logged-in-by-sftp-does-not-show-up-in-w .

  • Your answer and the Q&A you linked explain some details, but unfortunately don't solve my question. scp/sftp is not considered as interactive session, so there is no entry in /var/log/btmp or /var/log/wtmp. But if I want to check if a user is connected through sftp, I still don't know how to enable logging or where to find the logs. – lumbric Feb 26 '12 at 12:04
  • @lumbric check /var/log/auth.log – geirha Mar 1 '12 at 11:25
  • @geirha Oh wow, that was easy! If you convert it to an answer, I can award your answer for the bounty. – lumbric Mar 1 '12 at 14:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.