Is it possible to log the sftp logged in informations (Who accessed, when and from where )

Like which sftp user have logged on to the file server , This may also contain information such as ip address of the user.

The log may also give info such as directories accessed, and at last the commands executed.

I do have a dedicated centos server, of which root access is shared. So it is very important for me to track it.

If there is already a log file, may i know where on centos i can find it.


  • You are making a big confusion. SFTP works via SSH, it cannot be handled by vsftp. Either you use FTP or FTPS, or you are connecting to SFTP via the SSH protocol. – Florin Asăvoaie Aug 27 '14 at 15:11

SFTP as already mentioned works over ssh(port 22). So it's actual ssh users and you have to check corresponding logs.

It should be log: /var/log/secure if it's not rewritten by your actual rsyslog configuration.

| improve this answer | |
  • Thanks naveen, That helped and i found the ip and timestamp. However is there any file which do logs the commands run by the logged in user ? thanks – echoashu Aug 27 '14 at 16:02
  • Actually there are no such file. You can log actions of user with Snoopy or auditd(configured in a right way). In security file you have only commands which were run with "sudo". That is. – Navern Aug 27 '14 at 17:33

Easiest way to get that info is to type: last

| improve this answer | |
  • ahh!! simple enough :-) – echoashu Aug 28 '14 at 4:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.