sFTP process ids explained?

Question

Could someone explain to me the process that sftp makes when creating a connection and transferring data, on a control/data level? I know the basics about the ssh authentication and such, but for example, if I have the following in a log file:

Sep 16 15:31:34 localhost sshd[4274]: Postponed publickey for sftp1 from 172.16.221.1 port 56069 ssh2
Sep 16 15:31:34 localhost sshd[4273]: Accepted publickey for sftp1 from 172.16.221.1 port 56069 ssh2
Sep 16 15:31:34 localhost sshd[4273]: pam_unix(sshd:session): session opened for user sftp1 by (uid=0)
Sep 16 15:31:34 localhost sshd[4276]: subsystem request for sftp
Sep 16 15:31:36 localhost sshd[4276]: Received disconnect from 172.16.221.1: 11: disconnected by user
Sep 16 15:31:36 localhost sshd[4273]: pam_unix(sshd:session): session closed for user sftp1

Usually with regular ftp I would know that all these connections are related to one another by the process ID, how would you follow something like this when looking through a log file for sftp? The above example has three different process ids, gets confusing trying to follow it when there are other sftp connections going on at the same time. I have searched google and there are plenty of documents about how to set up an sftp server and such but nothing about understand how to interpret the flow of the data.

Thanks in advance.

Answer 1

Each of those process IDs--4274, 4276, and so on--represents a different instance of the sshd program handling a different client. So, if you looked at just the lines for PID 4274, you'd see the log messages for a particular sshd instance, handling a particular client connection.

Aside from that, I'm not sure what you're asking. I'll note that FTP makes a new TCP connection for each file being transferred, so you might see separate log entries for each file transfer. SFTP uses a single TCP connection for each session, and doesn't make new TCP connections for each file. SSHD and the SFTP server program don't normally log a lot of detail about what they're doing, either. So you won't see a lot of detail in the log about what the user is doing.