Topic: Information by a mail about upload files-Script for MySecureShell log

I looking for script who analyze MySecureShell log file and send information by the mail about upload, download files to user... Who help me? I don't have experience in script writing. Thanks.

I enable log file by add line

LogFile                 /var/log/sftp_server.log

in '/etc/ssh/sftp_config' file.

## MySecureShell Configuration File ##
#Default rules for everybody
<Default>
        LogFile                 /var/log/sftp_server.log

and I have sftp_server.log file

I see information about user and upload, download files

e.g.

2007-11-23 13:10:06 [34:40:1m[18760][tom][192.168.5.22]Upload into file '/In/C070381-ZPA221107.xls.pgp.filepart'[37:40:0m
2007-11-23 13:10:13 [31:40:1m[18760][tom][192.168.5.22]Try to rename '/In/C070381-ZPA221107.xls.pgp.filepart' -> '/In/C070381-ZPA221107.xls.pgp' : success[37:40:0m

I want send information -mail when user about upload files

e.g.

in topic 'MysecureShell user - tom'

and in contents

'Server MySecureShell notify about upload file(s) from user: tom

/home/sftpuser/tom/In/C070381-ZPA221107.xls.pgp
with date 2007-11-23 13:10:13

MySecureShell script'

where home/sftpuser/tom is Home path from  /home/sftpuser/$USER in /etc/ssh/sftp_config' file

good information in this mail was be info about size file but i don't see this information in log file

I thinking about change rights and time after file is upload - we eliminate limitation permission and date, when user have own setup client application e.x. WINSCP. Maybe to do from this script level?

Digression:
I use OpenSSH_4.3p2 Debian-9, OpenSSL 0.9.8c and I have another linux server where I don't have install MysecureShell. How setup log file in SSH config? I want see in log file e.g. information about connection and upload files by SSH(SFTP) in syslog like i have in  sftp_server.log It's possible without install MysecureShell?


Best regards
onyx

Re: Information by a mail about upload files-Script for MySecureShell log

Hi,

For the script please wait smile (difficult to have time with work sad)

onyx wrote:

I looking for script who analyze MySecureShell log file and send information by the mail about upload, download files to user... Who help me? I don't have experience in script writing. Thanks.

I enable log file by add line LogFile                 /var/log/sftp_server.log in '/etc/ssh/sftp_config' file.

## MySecureShell Configuration File ##
#Default rules for everybody
<Default>
        LogFile                 /var/log/sftp_server.log

and I have sftp_server.log file

I see information about user and upload, download files

e.g.

2007-11-23 13:10:06 [34:40:1m[18760][tom][192.168.5.22]Upload into file '/In/C070381-ZPA221107.xls.pgp.filepart'[37:40:0m
2007-11-23 13:10:13 [31:40:1m[18760][tom][192.168.5.22]Try to rename '/In/C070381-ZPA221107.xls.pgp.filepart' -> '/In/C070381-ZPA221107.xls.pgp' : success[37:40:0m

I want send information -mail when user about upload files

e.g.

in topic 'MysecureShell user - tom'

and in contents

'Server MySecureShell notify about upload file(s) from user: tom

/home/sftpuser/tom/In/C070381-ZPA221107.xls.pgp
with date 2007-11-23 13:10:13

MySecureShell script'

where home/sftpuser/tom is Home path from  /home/sftpuser/$USER in /etc/ssh/sftp_config' file

good information in this mail was be info about size file but i don't see this information in log file

I thinking about change rights and time after file is upload - we eliminate limitation permission and date, when user have own setup client application e.x. WINSCP. Maybe to do from this script level?

Maybe for the moment, it's a solution to do this in the script smile

onyx wrote:

Digression:
I use OpenSSH_4.3p2 Debian-9, OpenSSL 0.9.8c and I have another linux server where I don't have install MysecureShell. How setup log file in SSH config? I want see in log file e.g. information about connection and upload files by SSH(SFTP) in syslog like i have in  sftp_server.log It's possible without install MysecureShell?

If I'm right some (unofficial) patch exist to add sftp log but not include into OpenSSH...
So patch OpenSSH or install MySecureShell wink

Re: Information by a mail about upload files-Script for MySecureShell log

Here the famous script :

#!/bin/bash

LOG='/var/log/sftp-server.log'
MAIL='myemail@address.com'
SUBJECT='MySecureShell upload'


IFS=#

grep -i -e upload -e rename $LOG \
    | sed -r 's/^(.{19}).*\[(.*)\]\[.*\](.*)/\1#\2#\3/' |
while read when user file in $FILES ; do
    file=`echo $file | rev | cut -d"'" -f2 | rev`
    end=${file:(-9)}

    #Ignore partial upload
    if [ "$end" != '.filepart' ] ; then
mail -s $SUBJECT $MAIL << _EOF
New file uploaded by: $user

$file
with date $when
_EOF
    fi    
done

Enjoy big_smile

Re: Information by a mail about upload files-Script for MySecureShell log

Thanks but in my system don't working

I create file by

nano script.sh

with yours code
I paste and copy from forum to my file have X rights.
next i type

script

and have display info

Script started, file is typescript

and see file typescript but i don't have a mail with info about upload file.

size of typescript grown but I don't see only information upload  files

e.g.

0m.[m..[39;49m.[K.[?1049l.[?1049h.[1;24r.[4l.[?1h.=.[m..[37m.[40m.[1;24r.[H.[2J$
^[[37m^[[44m:29 CET

[37m.[40m.[m..[39;49m.[K.[?1049l.[?1049h.[1;24r.[4l.[?1h.=.[m..[37m.[40m.[1;24r$
m..[37m.[40m.[m..[39;49m.[K.[?1049l.[?1049h.[1;24r.[4l.[?1h.=.[m..[37m.[40m.[1;$

end I see all log but I don't have this log in my sftp_server.log this log I loose.

maybe I start wrong this script please verifiy my steps.

Re: Information by a mail about upload files-Script for MySecureShell log

To launch the script, just do:

./script.sh

Is it better?

Re: Information by a mail about upload files-Script for MySecureShell log

HI

I correct little error in

LOG='/var/log/sftp-server.log'

to

LOG='/var/log/sftp_server.log'

This char _ not - in name log file

end now I run script

./script.sh&

but i got all everything mail from log file

if I have in log file information about upload files from date 2007-10-17 to 2007-11-29

i got everything mail but i run script today e.g 2007-11-29 at 9:00 and next i upload one file I have to got one mail about this file.
imagine this situation i restart server i run this script again i got the same mail several times is this situation is good? I think so.

for me in this script miss procedure to check time run the script.
Except for the fact that i got all mail this mail not sorted i got first information about upload file with date 2007-11-15 15:16:13
next 2007-11-21 13:17:40
2007-11-20 14:13:36
2007-11-19 18:59:55
2007-11-20 17:26:08
....
2007-10-23 13:29:50
2007-11-06 11:38:33
2007-10-31 15:12:13
2007-10-18 11:55:35
etc...
and still got mail....

end now i see i got the same mail twice about information about upload the same file in the same time
e.g.
with date 2007-11-19 18:59:48

Maybe i run twice script


How to best stop this script?

I grep information from log file to temp file 

cat /var/log/sftp_server.log | grep Upload > zawupload.txt

I have 229 lines with upload file

but i got  393 mails about upload file and got still when the number of mails be 458 is be proof for me about i run twice the script

but still is problem i don't have all mail only from date run the script.

Please check my steps or code this script.

Thanks onyx

Re: Information by a mail about upload files-Script for MySecureShell log

hello again

I got six mail with the same information about upload file with
date 2007-11-09 07:26:12

I think is still little error in yours script.

Best regards
Onyx

I waiting for your answer.

smile

Re: Information by a mail about upload files-Script for MySecureShell log

No my script is correct but your configuration change log file name (see tag LogFile).

Run this script in background and wait for mails wink

#!/bin/bash

LOG='/var/log/sftp-server.log'
MAIL='myemail@address.com'
SUBJECT='MySecureShell upload'


IFS=#

tail -f $LOG | grep -i -e upload -e rename \
    | sed -r 's/^(.{19}).*\[(.*)\]\[.*\](.*)/\1#\2#\3/' |
while read when user file in $FILES ; do
    file=`echo $file | rev | cut -d"'" -f2 | rev`
    end=${file:(-9)}

    #Ignore partial upload
    if [ "$end" != '.filepart' ] ; then
mail -s $SUBJECT $MAIL << _EOF
New file uploaded by: $user

$file
with date $when
_EOF
    fi    
done

Re: Information by a mail about upload files-Script for MySecureShell log

Hi

I change name log file in configuration mysecureshell file, next copy&paste to script file, run script next upload testing file and nothing.

I didn't got any mail. sad

How check is script working? Where, in which log?

Previous script send all information but works.
This nothing.

Onyx

Re: Information by a mail about upload files-Script for MySecureShell log

Hi,

Are your sure the mail server on your ost is working ? Could you perform some tests to be sure this is ok.

Thanks

Re: Information by a mail about upload files-Script for MySecureShell log

onyx wrote:

Hi

I change name log file in configuration mysecureshell file, next copy&paste to script file, run script next upload testing file and nothing.

I didn't got any mail. sad

How check is script working? Where, in which log?

Previous script send all information but works.
This nothing.

Onyx

Sorry a little mistake.

Copy the new script, check LOG and MAIL and run big_smile

Re: Information by a mail about upload files-Script for MySecureShell log

Yes, my Postfix on this computer with MysecureShell working and send mail from another script to user.
I send also mail from shell by sendmail
e.g.

echo test | /usr/sbin/sendmail -f user@name.site.xx user@anothername.site.xx

Re: Information by a mail about upload files-Script for MySecureShell log

Try with this please smile

teka wrote:

No my script is correct but your configuration change log file name (see tag LogFile).

Run this script in background and wait for mails wink

#!/bin/bash

LOG='/var/log/sftp-server.log'
MAIL='myemail@address.com'
SUBJECT='MySecureShell upload'


IFS=#

tail -f $LOG | grep -i -e upload -e rename \
    | sed -r 's/^(.{19}).*\[(.*)\]\[.*\](.*)/\1#\2#\3/' |
while read when user file in $FILES ; do
    file=`echo $file | rev | cut -d"'" -f2 | rev`
    end=${file:(-9)}

    #Ignore partial upload
    if [ "$end" != '.filepart' ] ; then
mail -s $SUBJECT $MAIL << _EOF
New file uploaded by: $user

$file
with date $when
_EOF
    fi    
done