Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

As far as I know, when I SSH to a box, it will add my command history to something like .bash_history. But when I execute a command like rsync and it executes a remote SSH connection,

rsync -avz -e 'ssh -p1234'  "/example/" mylogin@17.19.20.99:"/example/"

where is that logged?

Another example might be using a SFTP client that uses SSH to connect (like expanDrive) - where are those connections logged?

Clarification: I am referring to logging on the remote machine. So, if a hacker ssh`ed to a box and didn't delete out the .bash_history, you could see what s/he did. But if a hacker used the rsync command instead, does that mean there would be no record of it on the remote machine? fyi - I'm trying to investigate some weird activity on my server, and checking the logs isn't turning anything up.

Thanks!

share|improve this question

2 Answers 2

up vote 1 down vote accepted

if the specific process that called those commands doesn't log them, nobody will.

AFAIK, neither rsync nor expanDrive have such logs.

share|improve this answer
    
i'm talking about logging on the remote machine. is that what you mean, too? See my clarification section in the original question. Thanks! –  cwd Mar 29 '11 at 13:53
    
Javier is right, remove sessions that don't execute a shell like bash won't get logged into a shell history. –  Ewan Leith Mar 31 '11 at 12:04

Some applications let you add a switch like --syslog to output some operating information or debugging information to /var/log/messages or /var/log/syslog.

In your own scripts you can use logger -- I WROTE THIS -- to write to syslog.

--edit--

        --log-file=FILE         log what we're doing to the specified FILE
        --log-file-format=FMT   log updates using the specified FMT

The above might help log activity.

share|improve this answer
    
i'm talking about logging on the remote machine. is that what you mean, too? See my clarification section in the original question. Thanks! –  cwd Mar 29 '11 at 13:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.