Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The following message showed up in my logwatch:

--------------------- SSHD Begin ------------------------ 

SFTP subsystem requests: 1 Time(s)

 ---------------------- SSHD End ------------------------- 

I understand that it means SFTP has been accessed, but does it mean that an active connection was made, or that it was only attempted? Would there be an alternative message if a connection had been attempted but failed?

share|improve this question
up vote 2 down vote accepted

Only successful login attempt via sftp yourusername@yourservername are logged into /var/log/auth.log marked with

TIMESTAMP SERVERNAME sshd[xxxx] subsystem request for sftp

which in turn is parsed by logwatch to show the count i.e. successful SFTP login counts

Unsuccessful attempts for sftp is not differentiated from normal ssh failure attempts in the log file. If you're using something like a GUI SSH/SFTP client on windows/osx/linux, and copied a file across, that'd generate that log entry.

If you haven't done any file copies at all, then you might want to poke at the box a bit.

share|improve this answer
Thanks for the answer. – Mechaflash Feb 6 '12 at 15:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.