1

As far as I know, when I SSH to a box, it will add my command history to something like .bash_history. But when I execute a command like rsync and it executes a remote SSH connection,

rsync -avz -e 'ssh -p1234'  "/example/" [email protected]:"/example/"

where is that logged?

Another example might be using a SFTP client that uses SSH to connect (like expanDrive) - where are those connections logged?

Clarification: I am referring to logging on the remote machine. So, if a hacker ssh`ed to a box and didn't delete out the .bash_history, you could see what s/he did. But if a hacker used the rsync command instead, does that mean there would be no record of it on the remote machine? fyi - I'm trying to investigate some weird activity on my server, and checking the logs isn't turning anything up.

Thanks!

2 Answers 2

2

if the specific process that called those commands doesn't log them, nobody will.

AFAIK, neither rsync nor expanDrive have such logs.

2
  • i'm talking about logging on the remote machine. is that what you mean, too? See my clarification section in the original question. Thanks!
    – cwd
    Mar 29, 2011 at 13:53
  • Javier is right, remove sessions that don't execute a shell like bash won't get logged into a shell history.
    – Ewan Leith
    Mar 31, 2011 at 12:04
0

Some applications let you add a switch like --syslog to output some operating information or debugging information to /var/log/messages or /var/log/syslog.

In your own scripts you can use logger -- I WROTE THIS -- to write to syslog.

--edit--

        --log-file=FILE         log what we're doing to the specified FILE
        --log-file-format=FMT   log updates using the specified FMT

The above might help log activity.

1
  • i'm talking about logging on the remote machine. is that what you mean, too? See my clarification section in the original question. Thanks!
    – cwd
    Mar 29, 2011 at 13:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .