Rocky linux sftp logs are not getting recorded to /var/vlog/sftp.log
I have added the below line to /etc/rsyslog.d/sftplog.conf #Output to SFTP.log
local6.* /var/log/sftp.log
and on rsyslog.conf
I thought you’d forgotten the special character “*” but once I copied your line it appeared and to see it in a post you have to “\” escape it so now I don’t know why you are not getting the log output. Are you getting any of the other logs configured in /etc/rsyslog.conf?
What is the output of:
You didn’t answer if you were getting the other log files in /var/log/ defined in /etc/rsyslog.conf. This is helpful to know so to narrow the scope of what is causing the problem.
Does sftp have its own config file(s) in /etc? You might want to look there to see if it defines the logging path. It could be in contradiction to what you have defined in /etc/rsyslog.d/sftp.conf
The default logs that capture ssh traffic are:
/var/log/audit/audit
/var/log/secure
Outgoing traffic is not logged at all with the default settings in your machine ssh_config. Incoming traffic only logs the authentication activity but not the transfer protocol. The default log level is INFO. So first it would be necessary to change the default log level to a more informative one in the machine ssh_config and then do some test scp/sftp transfers and check the two logs identified above in the host and destination machines to see if you are going to get the filterablle traffic to provide output for the rsyslog script.