I have enabled logging in SFTPD by adding including the following in my /etc/sshd_config
subsystem sftp /usr/libexec/sftp-server -l DEBUG
But I can't find any log files. Where does sftp log on OS X v10.9.2 ?
-
On what version of Apple's OS did you make this change?– bmike ♦Commented May 1, 2014 at 23:33
-
The version is v10.9.2– SynessoCommented May 1, 2014 at 23:50
Add a comment
|
3 Answers
On my machine, (10.9.2) changing the log level for the sftp server in sshd just makes everything spit out onto /var/system.log/ along with the rest of sshd's log output.
e.g. part of my system.log filtered for 'sftp' after a single connect
May 1 19:57:55 joes-imac.local sshd[50141]: subsystem request for sftp by user joe
May 1 20:01:09 joes-imac.local sshd[50199]: subsystem request for sftp by user joe
May 1 20:01:09 joes-imac.local sftp-server[50200]: session opened for local user joe from [::1]
May 1 20:01:09 joes-imac.local sftp-server[50200]: received client version 3
May 1 20:01:09 joes-imac.local sftp-server[50200]: realpath "."
May 1 20:02:31 joes-imac.local sftp-server[50200]: opendir "/Users/joe"
May 1 20:02:31 joes-imac.local sftp-server[50200]: sent status End of file
After enabling DEBUG logging in my sshd_config, which has now moved to /etc/ssh/sshd_config btw, I was able to view this log just using the macOS system wide log utility. Specifically, I just ran this:
$ log stream --debug --info --predicate "process Contains[c] 'sftp'"
...
...
2022-04-03 14:19:36.390960-0400 0x957ea7 Debug 0x0 633 0 sftp-server: debug1: request 622: read "/Users/chris/some_file" (handle 0) off 94011584 len 30000
2022-04-03 14:19:36.391016-0400 0x957ea7 Debug 0x0 633 0 sftp-server: debug1: request 622: sent data len 30000
2022-04-03 14:19:36.391102-0400 0x957ea7 Debug 0x0 633 0 sftp-server: debug1: request 623: read "/Users/chris/some_file" (handle 0) off 94041584 len 30000
2022-04-03 14:19:36.391180-0400 0x957ea7 Debug 0x0 633 0 sftp-server: debug1: request 623: sent data len 30000
...
This is on macOS 10.15 Catalina for reference. Hope this helps!
Use the log program. Look at its man page.