4

I can't seem to get SCP logs (on the server) to show up anywhere. I've searched through quite a few pages, including:

scp / ssh log on ssh-server

http://ubuntuforums.org/showthread.php?t=1789437

http://ubuntuforums.org/showthread.php?t=851891

I've tried on 10.04 (yes, EOL, etc.) with OpenSSH 5.3 and 12.04 with OpenSSH 5.9, I've enabled all levels of logging including DEBUG3 in /etc/ssh/sshd_config, and tried regular users and root, but nothing about the file that was transferred (or even that a file was transferred) shows up in any log for SCP. SFTP logs show up in auth.log even without cranking up the LogLevel to VERBOSE.

Is there anything I'm missing? Can anyone confirm they are able to get SCP logs to show up somewhere?

Thanks

0

2 Answers 2

6

scp is executed internally just as ssh command and transferred files are not logged. You have only authentication logs in /var/log/auth.log or somewhere like this.

2
  • 1
    This was downvoted to zero, and not only is it 100% correct -- it's the simplest answer. Commented Mar 15, 2019 at 17:10
  • @ScottPrive I think the reason it was downvoted is because simply saying "there are no logs" isn't really useful to someone who stumbles upon this answer after feverishly searching for ways of logging such traffic.
    – CoolKoon
    Commented May 28, 2021 at 11:31
4

I studied this once when I had to come up with a way to monitor SCP transfers. The OpenSSH scp utility doesn't log anything. It supports debugging output for the underlying SSH session, but that won't log the actual file transfers which are taking place.

Similarly, the OpenSSH server can be set to log detail about what it's doing, and it can be set to log the fact that a user connected and ran scp, but it won't log the actual file transfers which are taking place.

If you can't get these users to use SFTP instead, there are three approaches available to you:

  1. Investigate commercial SSH/SFTP/SCP servers. They should generally support logging file transfers.

  2. Replace the scp utility on the server with one that logs the data you want. OpenSSH is open source. Someone who knows how to program in C for Unix could download the source and modify it.

  3. Replace the scp utility with a "wrapper" that launches the original scp program and monitors what it does. There are debugging tools for Unix which can monitor what another process is doing.

We took the third approach. We wrote a Perl script which launched the original scp program under strace. Strace would output the names of files being opened and closed by the scp process. The Perl script read the strace output and converted it to log entries.

3
  • "incron" would be #4 and probably easier than your 3 ;)
    – Rinzwind
    Commented Aug 11, 2015 at 17:02
  • @Rinzwind I don't see a way to limit incron to trigger on events from a specific program (like scp), or to tell what process triggered an event.
    – Kenster
    Commented Aug 11, 2015 at 18:11
  • I would have upvoted if 1 and 3 were reversed...
    – Fabby
    Commented Aug 13, 2015 at 2:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .