The following message showed up in my logwatch:
--------------------- SSHD Begin ------------------------
SFTP subsystem requests: 1 Time(s)
---------------------- SSHD End -------------------------
I understand that it means SFTP has been accessed, but does it mean that an active connection was made, or that it was only attempted? Would there be an alternative message if a connection had been attempted but failed?