How to Log SFTP File Transfers Without a Chroot

Updated: 28 September 2026 · Applies to: OpenSSH 9 and 10 on AlmaLinux and Rocky Linux 9 and 10, RHEL 9 and 10, Ubuntu 24.04 and 26.04, Debian 13

By default the SFTP server logs only logins, not what users do. To see which files a user uploads, downloads, renames or deletes, raise the log level of the sftp-server subsystem. This works for normal SSH users and does not need a chroot. We tested it on Debian 13 (OpenSSH 10.0) and checked the configuration on AlmaLinux 9 and 10 and Ubuntu 24.04.

1. Raise the SFTP log level

Create /etc/ssh/sshd_config.d/10-sftp-logging.conf. Use the sftp-server path of your distribution:

# AlmaLinux, Rocky Linux, RHEL
Subsystem sftp /usr/libexec/openssh/sftp-server -l INFO -f LOCAL3

# Ubuntu, Debian
Subsystem sftp /usr/lib/openssh/sftp-server -l INFO -f LOCAL3

• -l INFO logs every file operation (open, close with bytes read and written, remove, rename, mkdir). VERBOSE adds a little more detail.
• -f LOCAL3 sends the messages to the syslog facility local3, so you can write them to their own file. Without it they go to the auth log with the SSH logins.

sshd uses the first Subsystem line it reads, and the files in sshd_config.d are read before the main file, so this file takes effect without editing /etc/ssh/sshd_config. Check and restart:

sshd -t
systemctl restart sshd    # AlmaLinux, Rocky Linux, RHEL
systemctl restart ssh     # Ubuntu, Debian

Confirm the active setting with sshd -T | grep subsystem.

2. Write SFTP messages to their own file

Create /etc/rsyslog.d/10-sftp.conf:

local3.*    /var/log/sftp.log
& stop

& stop keeps these messages out of /var/log/messages or /var/log/syslog. Check and restart rsyslog:

rsyslogd -N1
systemctl restart rsyslog

rsyslog is installed by default on AlmaLinux, Rocky Linux, RHEL and Ubuntu. On Debian 13 install it with apt install rsyslog, or skip this step and read the messages from the journal: journalctl -t sftp-server.

What the log looks like

sftp-server[8675]: session opened for local user alice from [203.0.113.9]
sftp-server[8675]: open "/home/alice/up.txt" flags WRITE,CREATE,TRUNCATE mode 0644
sftp-server[8675]: close "/home/alice/up.txt" bytes read 0 written 3
sftp-server[8675]: remove name "/home/alice/up.txt"
sftp-server[8675]: session closed for local user alice from [203.0.113.9]

Rotate the log

Add /var/log/sftp.log to log rotation, for example in /etc/logrotate.d/sftp:

/var/log/sftp.log {
    weekly
    rotate 8
    compress
    missingok
    notifempty
    postrotate
        systemctl kill -s HUP rsyslog.service >/dev/null 2>&1 || true
    endscript
}

Chrooted SFTP users

Users locked into a chroot with ForceCommand internal-sftp do not run sftp-server, so the line above does not apply to them. Add the options to their command instead, for example ForceCommand internal-sftp -l INFO -f LOCAL3, then check with sshd -t and restart sshd.

Official documentation: sftp-server manual and sshd_config manual.