who for ftp

[Daniel Robitaille]

2009/3/31 Bob Jonkman <bjonkman at sobac.com>:

> I think I can get the info out of auth.log, but that's going to take some
> logfile parsing to eliminate all the doorknob-rattlers trying to break in,
> and to remove the logged-out connections.
>
> grep opened /var/log/auth.log | grep sshd
>
> is a start.  Doesn't appear to show the SFTP or SCP sessions, tho.
>
> I'll keep at it.  Further suggestions are welcome...

To do some filtering on auth.log (or any other log file), you can use lwatch:

http://packages.ubuntu.com/hardy/lwatch

I would have guessed sftp or scp logins would appear in that file.
I'll have to check the logs of my own servers...


-- 
Daniel Robitaille