Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is there a way to keep a log of the files copied using SCP? I am administering a server which contains some files that should be monitored (in a specific folder and its subfolders), so when someone copies them via SSH, the copying process should be logged.

I thought of looking into the Bash command history of users and search for commands that start with scp, but that's blatant invasion of privacy and it's also very easy for users to delete this history (even without bad intent).

Does anyone know a way for this? I can make a web-based interface to the server with usernames/passwords and logging downloads would be easy then, but I'm interested in a "bare metal" solution, if there's one.

EDIT: I looked over SSHD's logging options, like FascistLogging, or Debug logging, but those didn't seem very appropriate. Are they actually the solution?

EDIT 2: I'm beginning to believe that this question shouldn't be on Stack Overflow, but rather on Server Fault... What should I do?

share|improve this question

migrated from May 23 '12 at 8:22

This question came from our site for professional and enthusiast programmers.

Nothing, it has already been migrated by a moderator. – Silviu May 23 '12 at 8:28

5 Answers 5

up vote 5 down vote accepted

I would use incron. It utilizes Linux kernel inotify subsystem and if some monitored directory tree / file gets modified, you can execute anything you want. The incrontab file format is very straightforward, for example

/your/directory IN_MODIFY /usr/local/bin/ $@/$#

would run /usr/local/bin/ every time something gets modified at /your/directory directory tree, calling the script with the full path ($@ argument) and the file that got modified ($# argument).

Your script could be about as simple as

logger -t modification_stalker "Yo dawg, these files got modified $1 $2 ..." 
share|improve this answer
I didn't think about this, awesome! I kept postponing delving into inotify, I never thought it's that easy. +1 (if I had enough rep) – CamilB May 23 '12 at 9:03

sshd option is useless here. scp just run something like 'scp -t -- dest_file' on remote host.

Simpliest way - create wrapper around real scp program, for logging command-line arguments.

share|improve this answer
There's a problem with that: scp will be executed by the users on their computers, while I want the log on the server. And unfortunately I cannot wrap scp, nor change scp itself on their computers. That's why I thought sshd was supposed to do the logging... – Camil Bancioiu May 23 '12 at 7:08
@CamilB But modofocation on the server should be feasible? – glglgl May 23 '12 at 9:27
@glglgl: Yes, I've set up the server myself and I can change everything. – CamilB May 23 '12 at 16:47
@CamilBancioiu Fine! So that's all you need. – glglgl May 24 '12 at 6:08

I realise now this is only sftp and not scp as originally requested however I'm leaving the answer here to help people.

Been trying to find the answer to this myself so here goes.

Firstly, you need to enable logging of the sftp subprogram that ssh uses:

In /etc/ssh/sshd_config

Subsystem   sftp    /usr/libexec/openssh/sftp-server -l INFO

Then restart sshd however your particular distribution does it:

service sshd restart

Now we you should see scp log messages appearing in something like /var/log/messages, or maybe /var/log/auth.log depending on your syslog setup.

I'm using syslog-ng and want my logs for sftp transfers separate from the rest of the logs for ssh.

In /etc/syslog-ng/syslog-ng.conf:

#sftp configuration
destination sftp { file("/var/log/sftp.log"); };
filter f_sftp { program("sftp-server"); };
log { source(s_src); filter(f_sftp); destination(sftp); };

This means logs now go to /var/log/sftp.log - you may need to edit program("sftp-server") to match whichever program you're using in SSH as there is various options

Finally, to stop the logs also going into the ssh log, we filter them out:

        filter f_auth { facility(auth, authpriv) and not filter(f_debug) and not filter(f_sftp); };

Restart syslog-ng (or your syslog daemon): * When I tried just reloading the changes didn't work, I had to restart it.

service syslog-ng restart
share|improve this answer
it seems this answer is not completely correct. connecting via SFTP is not equal to connecting via SCP. As how this differs in the logging directly i do not know. – Dennis Nolte Oct 29 at 8:55
@DennisNolte I realise they aren't the same in that way, I've only just realised filezilla is claiming to use sftp and not scp as I presumed it was. I'll update my answer to be sftp specific. – djsmiley2k Oct 29 at 11:04

OpenSSH supports logging of scp. So if you turn it on VERBOSE mode you will even see the directories your clients traversed.

To see the log check

share|improve this answer
I'll check this soon, thanks! – CamilB May 23 '12 at 9:04
@Silviu - setting LogLevel VERBOSE does not log files or directory transfers in /var/log/auth.log – Martin Vegter Jun 10 '14 at 22:33

You can set up verbose logging level for sshd and use some audit software, e.g. auditd to create reports based on log messages.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.