3

I have enabled logging in SFTPD by adding including the following in my /etc/sshd_config

subsystem       sftp    /usr/libexec/sftp-server -l DEBUG

But I can't find any log files. Where does sftp log on OS X v10.9.2 ?

2
  • On what version of Apple's OS did you make this change?
    – bmike
    May 1, 2014 at 23:33
  • The version is v10.9.2
    – Synesso
    May 1, 2014 at 23:50

3 Answers 3

1

On my machine, (10.9.2) changing the log level for the sftp server in sshd just makes everything spit out onto /var/system.log/ along with the rest of sshd's log output.

e.g. part of my system.log filtered for 'sftp' after a single connect

May  1 19:57:55 joes-imac.local sshd[50141]: subsystem request for sftp by user joe
May  1 20:01:09 joes-imac.local sshd[50199]: subsystem request for sftp by user joe
May  1 20:01:09 joes-imac.local sftp-server[50200]: session opened for local user joe from [::1]
May  1 20:01:09 joes-imac.local sftp-server[50200]: received client version 3
May  1 20:01:09 joes-imac.local sftp-server[50200]: realpath "."
May  1 20:02:31 joes-imac.local sftp-server[50200]: opendir "/Users/joe"
May  1 20:02:31 joes-imac.local sftp-server[50200]: sent status End of file
0

After enabling DEBUG logging in my sshd_config, which has now moved to /etc/ssh/sshd_config btw, I was able to view this log just using the macOS system wide log utility. Specifically, I just ran this:

$ log stream --debug --info --predicate "process Contains[c] 'sftp'"
...
...
2022-04-03 14:19:36.390960-0400 0x957ea7   Debug       0x0                  633    0    sftp-server: debug1: request 622: read "/Users/chris/some_file" (handle 0) off 94011584 len 30000
2022-04-03 14:19:36.391016-0400 0x957ea7   Debug       0x0                  633    0    sftp-server: debug1: request 622: sent data len 30000
2022-04-03 14:19:36.391102-0400 0x957ea7   Debug       0x0                  633    0    sftp-server: debug1: request 623: read "/Users/chris/some_file" (handle 0) off 94041584 len 30000
2022-04-03 14:19:36.391180-0400 0x957ea7   Debug       0x0                  633    0    sftp-server: debug1: request 623: sent data len 30000
...

This is on macOS 10.15 Catalina for reference. Hope this helps!

-1

Use the log program. Look at its man page.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .