Skip to content

Auditing (Message Logging)

The following auditing services are always enabled.

  • Login history

  • Currently logged in users

  • Failed logins

You can also configure additional auditing to maintain a record of file transfer activity. This auditing is not enabled by default. For more information, see Configure File Transfer Auditing.

The table below summarizes keywords used for configuring auditing.

Keyword Description
AuditLog Specifies whether or not an audit log is created. Valid values are 'sftp' and 'none'. When 'sftp' is specified, a comma-delimited log file containing a detailed record of file transfer activity is created in the location specified by AuditLog.Directory. The first line of the audit log file, shown here, identifies the logged content:

UserID,ClientIP,Action,ServerFilename,StartTime,EndTime,ServerFileModificationTime,ServerFileSize,BytesTransferred,Result,Reason,ServerFileHash. The default is 'none'.
AuditLog.Directory The output location for audit logs. A new log is created each day using this name format: sshd2-audit-YYYYMMDD.log, where YYYYMMDD indicates the date. When AuditLog = sftp, this file is created the first time a client user transfers a file, or when you restart the server. The default is /opt/microfocus/rsit/etc/logs.
AuditLog.Sftp.WithHash Specifies whether or not sftp log entries include a file hash. The hash value can be used to identify multiple records identifying transfer of the same file. Each time an unchanged file is transferred, the hash value in the log is identical. If a file is changed, the hash value is different. The default is 'yes'.
SyslogFacility A facility code for sshd messages. The value of SyslogFacility must correspond to a facility specified in syslog.conf. The default is 'AUTH'.
SftpSysLogfacility A facility code for sftp-server messages. When no value is configured (the default) sftp-server uses the current facility configured for sshd. Use SftpSysLogFacility to specify an alternate facility for sftp server logging. Sending sftp messages to a different facility is often useful for auditing. The value of SftpSysLogFacility must correspond to a facility specified in syslog.conf.
SftpLogCategory Specifies which categories of sftp server messages are sent to the facility specified by SftpSysLogFacility. The default is 'loginlogout,directorylistings,downloads,modifications,uploads', which configures logging of all categories. You can specify any of those options, plus 'all', or 'none'.
LogLevel The level of logging to SysLogFacility and SftpSysLogFacility. After the configuration file is read, messages are processed according to rules defined in syslog.conf. This level applies to both sshd and sftp logging.