Home / server / Questions / 357228
Accepted
Anthony Miller
Asked: 2012-02-07 06:42:38 +0800 CST

Meaning of "SFTP subsystem requests"

  • 772

The following message showed up in my logwatch:

--------------------- SSHD Begin ------------------------ 

SFTP subsystem requests: 1 Time(s)

 ---------------------- SSHD End -------------------------

I understand that it means SFTP has been accessed, but does it mean that an active connection was made, or that it was only attempted? Would there be an alternative message if a connection had been attempted but failed?

linux sftp logwatch

1 Answers

  1. Best Answer

    Only successful login attempt via sftp yourusername@yourservername are logged into /var/log/auth.log marked with 

    TIMESTAMP SERVERNAME sshd[xxxx] subsystem request for sftp

    which in turn is parsed by logwatch to show the count i.e. successful SFTP login counts

    Unsuccessful attempts for sftp is not differentiated from normal ssh failure attempts in the log file. If you're using something like a GUI SSH/SFTP client on windows/osx/linux, and copied a file across, that'd generate that log entry.

    If you haven't done any file copies at all, then you might want to poke at the box a bit.

    • 2