File Access Logs

[mckendry1011]

I have a CentOS server which I use as an offsite backup server and it is accessed remotely either through WinSCP or Putty. 

 

Is there any way to view the IP address, PC name and what has been accessed/downloaded through either WinSCP or Putty?

 

Thanks

[Mira Yurizaki]

https://serverfault.com/questions/273889/how-do-i-find-out-the-recent-ssh-logins-for-centos-and-their-ip-address/273891

 

This is for SSH activity, which SCP rides on. I'm assuming the PuTTY connection is also over SSH.

[Mikensan]

You would want to enable verbose logging for SSH I believe. You should be able to feed this log into something like ELK to parse it and easier to read. Or you could feed it into Splunk but I think that's more time/effort than ELK.

https://en.wikibooks.org/wiki/OpenSSH/Logging_and_Troubleshooting#Logging_Chrooted_SFTP