1

As far as I know, when I SSH to a box, it will add my command history to something like .bash_history. But when I execute a command like rsync and it executes a remote SSH connection,

rsync -avz -e 'ssh -p1234'  "/example/" mylogin@17.19.20.99:"/example/"

where is that logged?

Another example might be using a SFTP client that uses SSH to connect (like expanDrive) - where are those connections logged?

Clarification: I am referring to logging on the remote machine. So, if a hacker ssh`ed to a box and didn't delete out the .bash_history, you could see what s/he did. But if a hacker used the rsync command instead, does that mean there would be no record of it on the remote machine? fyi - I'm trying to investigate some weird activity on my server, and checking the logs isn't turning anything up.

Thanks!

2

if the specific process that called those commands doesn't log them, nobody will.

AFAIK, neither rsync nor expanDrive have such logs.

2
  • i'm talking about logging on the remote machine. is that what you mean, too? See my clarification section in the original question. Thanks! – cwd Mar 29 '11 at 13:53
  • Javier is right, remove sessions that don't execute a shell like bash won't get logged into a shell history. – Ewan Leith Mar 31 '11 at 12:04
0

Some applications let you add a switch like --syslog to output some operating information or debugging information to /var/log/messages or /var/log/syslog.

In your own scripts you can use logger -- I WROTE THIS -- to write to syslog.

--edit--

        --log-file=FILE         log what we're doing to the specified FILE
        --log-file-format=FMT   log updates using the specified FMT

The above might help log activity.

1
  • i'm talking about logging on the remote machine. is that what you mean, too? See my clarification section in the original question. Thanks! – cwd Mar 29 '11 at 13:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.