who for ftp

Daniel Robitaille robitaille at gmail.com
Tue Mar 31 23:48:28 UTC 2009

2009/3/31 Bob Jonkman <bjonkman at sobac.com>:

> I think I can get the info out of auth.log, but that's going to take some
> logfile parsing to eliminate all the doorknob-rattlers trying to break in,
> and to remove the logged-out connections.
> grep opened /var/log/auth.log | grep sshd
> is a start.  Doesn't appear to show the SFTP or SCP sessions, tho.
> I'll keep at it.  Further suggestions are welcome...

To do some filtering on auth.log (or any other log file), you can use lwatch:


I would have guessed sftp or scp logins would appear in that file.
I'll have to check the logs of my own servers...

Daniel Robitaille

More information about the ubuntu-ca mailing list