(2017-10-10)
Problem
Need to log sftp traffic in my chroot'd user directories.
Solution
in /etc/ssh/sshd_config:
# override default of no subsystems
Subsystem sftp internal-sftp -f LOCAL7 -l INFO
Be sure that all instances of your
internal-sftp in
sshd_config are similarly modified.
in rsyslogd.conf:
$AddUnixListenSocket /var/spool/rsyslog/rsyslog-sftp
# Parse the data logged at level INFO and facility LOCAL7 into /var/log/sftp.log
local7.info /var/log/sftp.log# Report logins and logoffs
:syslogtag,startswith,"sftp-server" /var/log/sftp.log
...and restart rsyslog
In each chroot home directory:
# ln /var/spool/rsyslog/rsyslog-sftp dev/log
(
Source)