Re: SSH / SFTP client log

On the system I built, I chose the -vvv method with details to a file.

The process will append any new connection details to the end of the file, but I generate a time stamp header so searching is simple.

I further enhanced this process by creating a method of detecting ANY “keyword phrase” from the last log entry to determine if there were any errors in the transfer.
I have a user maintained table that contains error keyword phrase, error explanation, and suggested resolution. I then developed a procedure to cross reference any error keyword phrase from that log to the table to link the “plain English” verbiage of the failure to be emailed to our product support on any failure.

Probably more than you wanted to hear but it’s been working great with this “built in, error definition” process.

Remote ip, user, ssh and password auth (if using expect) are also included in the transfer details.

Jay

Sent from my iPhone

On Oct 11, 2019, at 4:38 PM, Steinmetz, Paul via MIDRANGE-L <midrange-l@xxxxxxxxxxxxxxxxxx> wrote:

I decided on method 3.
Created a WRKWCH, looking at joblogs, comparison data "QSH CMD('/QOpenSys/bin/sftp"

I now have a real time, SSH/SFTP monitor, which also writes to a SSH/SFTP log file.
I will be adding another comparison data for FTP.
Info captured thus far, will be adding more.

Job name
Job user
Job number
Job date
Job time
Program name
Location and name of SSH/SFTP script.
SSH/SFTP remote URL

Paul



-----Original Message-----
From: Steinmetz, Paul
Sent: Monday, October 07, 2019 4:30 PM
To: 'Midrange Systems Technical Discussion' <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: SSH / SFTP client log

I'm trying to capture and document all SSH /SFTP connections.
Majority, the Power I is the client, so we are either putting or getting files from 3rd party remotes.

TRCCNN on port 22 is one ugly method, needs a lot of massaging.

A second method could be a scan of all joblogs searching for: "4900 - QSH CMD('/QOpenSys/bin/sftp"
A third method could be WRKWCH - comparison data "4900 - QSH CMD('/QOpenSys/bin/sftp"

Problem with methods 2 and 3, It would only have Job, date, time, no specific SSH/SFTP credentials.

A fourth method would be to add -vvv (verbose trace) to all SSH configs, then dump the output to a file, then filter out what is needed, possible but ugly like method 1.

Is there another cleaner method, that might include Remote IP, SSH/SFTP user, Open SSH details, etc ?

Thank You
_____
Paul Steinmetz
IBM i Systems Administrator

Pencor Services, Inc.
462 Delaware Ave
Palmerton Pa 18071

610-826-9117 work
610-826-9188 fax
610-349-0913 cell
610-377-6012 home

psteinmetz@xxxxxxxxxx
http://www.pencor.com/

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate link: https://amazon.midrange.com