4

We use sshfs in quite a few situations.

We were wondering if there was a way to log the read / writes made to the sshfs mounts we have so we could optimize things on our local side (eg: tweaking cache, locally caching objects, etc).

Any ideas?

anonymous-one
  • 958
  • 4
  • 26
  • 43
  • I'm not sure if there are sshfs logging functions.. but you could probably get a good amount of change info running something like AIDE or tripwire. – NickW Nov 05 '13 at 12:21

1 Answers1

3

sshfs is a client application, it uses sftp on the server side. Have a look at the manual pages of sftp-server(8) and sshd_config(5).

In /etc/ssh/sshd_config, you should put something like (not sure if quotes are needed, try it yourself):

Subsystem sftp "/usr/lib/ssh/sftp-server -l INFO"

This will log details using the AUTH facility (/var/log/auth.log on Debian with rsyslogd). To separate SFTP logs from regular authentication messages, you can specify a different facility or redirect the logs. For rsyslogd, you can create /etc/rsyslog.d/sftp.conf containing:

:programname,isequal,"sftp-server" /var/log/sftp.log

Note that if your sftp user is chrooted, you need to create a /dev/log socket such that sftp can send messages to the syslog daemon. For rsyslogd, this can be done by creating the dev directory and adding the following line to sftp.conf:

$AddUnixListenSocket /home/user/dev/log
Lekensteyn
  • 6,111
  • 6
  • 37
  • 55