As far as I know, when I SSH to a box, it will add my command history to something like .bash_history. But when I execute a command like rsync and it executes a remote SSH connection,
rsync -avz -e 'ssh -p1234' "/example/" email@example.com:"/example/"
where is that logged?
Another example might be using a SFTP client that uses SSH to connect (like expanDrive) - where are those connections logged?
Clarification: I am referring to logging on the remote machine. So, if a hacker ssh`ed to a box and didn't delete out the .bash_history, you could see what s/he did. But if a hacker used the rsync command instead, does that mean there would be no record of it on the remote machine? fyi - I'm trying to investigate some weird activity on my server, and checking the logs isn't turning anything up.