Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The following message showed up in my logwatch:

--------------------- SSHD Begin ------------------------ 

SFTP subsystem requests: 1 Time(s)

 ---------------------- SSHD End ------------------------- 

I understand that it means SFTP has been accessed, but does it mean that an active connection was made, or that it was only attempted? Would there be an alternative message if a connection had been attempted but failed?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Only successful login attempt via sftp yourusername@yourservername are logged into /var/log/auth.log marked with

TIMESTAMP SERVERNAME sshd[xxxx] subsystem request for sftp

which in turn is parsed by logwatch to show the count i.e. successful SFTP login counts

Unsuccessful attempts for sftp is not differentiated from normal ssh failure attempts in the log file. If you're using something like a GUI SSH/SFTP client on windows/osx/linux, and copied a file across, that'd generate that log entry.

If you haven't done any file copies at all, then you might want to poke at the box a bit.

share|improve this answer
    
Thanks for the answer. –  Mechaflash Feb 6 '12 at 15:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.