SFTP / SCP / SSH events

30004

Message:

Global request "%(request_type)s" declined.

Groups:

authenticated, informational, ssh

From version:

3.18.0

Description:

None

Data:
request_type:

Request type that was rejected.

30005

Message:

SSH command %(message_id)s is not supported. %(payload)s

Groups:

operational, authenticated, failure, failure-specific, ssh

From version:

3.1.0

Description:

None

Data:
message_id:

ID of the command as specified by the SSH Standard.

payload:

The data received together with the SSH command.

30006

Message:

Internal error. Failed to process the SSH command %(message_id)s - %(payload)s. %(details)s

Groups:

operational, session, failure, failure-critical, ssh

From version:

3.1.0

Description:

None

Data:
message_id:

ID of the command as specified by the SSH Standard.

payload:

The data received together with the SSH command.

30007

Message:

SSH protocol failure at userauth service. %(details)s

Groups:

authentication, session, failure, failure-high, ssh

From version:

3.1.0

Description:

None

Data:
method:

Name of the requested SSH authentication method.

30008

Message:

SSH request rejected. %(details)s

Groups:

authenticated, failure, ssh

From version:

1.6.0

Description:

None

30009

Message:

Start processing '%(command)s' command.

Groups:

operational, authenticated, informational, ssh

From version:

3.45.0

Description:

None

Data:
command:

Name of the requested command.

30010

Message:

End processing '%(command)s' command.

Groups:

operational, authenticated, informational, ssh

From version:

3.45.0

Description:

None

Data:
command:

Name of the requested command.

30011

Message:

Subsystem %(service_name)s successfully started in "%(real_path)s" as "%(virtual_path)s". Protected using %(host_key)s %(key_exchange)s %(in_hmac)s %(in_cipher)s compression:%(in_compression)s.

Groups:

authentication, authenticated, success, ssh

From version:

1.6.0

Description:

None

Data:
in-compression:

Compression used to receive data.

in_cipher:

Cipher used for received data.

in_hmac:

Hash-based message authentication code for received data.

max_packet_local:

The maximum packet size we can receive.

max_packet_remote:

The maximum packet size we can send.

out-compression:

Compression used to send data.

out_cipher:

Cipher used for sent data.

out_hmac:

Hash-based message authentication code for sent data.

real_path:

Path on the server's filesystem where SFTP session was initiated.

service_name:

Name of the SSH subsystem used. Ex SFTP or SCP.

virtual_path:

Path of the folder in the virtual filesystem where sessions was initiated.

window_local:

How much more data can be received before the server will ask to extend the receive buffer.

window_remote:

How much more data can be send before the server will wait for the client to to extend the send buffer.

30012

Message:

SFTP subsystem closed. Using SFTP version %(client_version)s.

Groups:

authenticated, success, ssh

From version:

1.6.0

Description:

None

Data:
client_version:

SFTP version used for the connection.

30013

Message:

SSH algorithms negotiation failed at %(type)s. Client: "%(client_algorithms)s". Server: "%(server_algorithms)s".

Groups:

session, failure, failure-high, failure-specific, ssh

From version:

5.1.0

Description:

Emitted when we don't have a match for the client and server algorithms.

Data:
client_algorithms:

List of algorithm supported by client.

server_algorithms:

List of algorithm supported by server.

type:

The type of algorithm for which no common value was found.

30014

Message:

New SSH connection made.

Groups:

session, success, ssh

From version:

1.6.0

Description:

None

30015

Message:

SSH connection closed from "%(client_version)s". Protected using host-key:%(host_key)s key-exchange:%(key_exchange)s in-hmac:%(in_hmac)s in-cipher:%(in_cipher)s out-hmac:%(out_hmac)s out-cipher:%(out_cipher)s in-compression:%(in_compression)s out-compression:%(out_compression)s

Groups:

authenticated, informational, ssh

From version:

1.6.0

Description:

None

Data:
client_version:

SSH version advertised by the client.

host_key:

Host key algorithm in used to identify the server-side.

in-compression:

Compression used to receive data.

in_cipher:

Cipher used for received data.

in_hmac:

Hash-based message authentication code for received data.

key_exchange:

Key exchange algorithm used by the connection.

out-compression:

Compression used to send data.

out_cipher:

Cipher used for sent data.

out_hmac:

Hash-based message authentication code for sent data.

30016

Message:

Failed to process the SFTP command. %(details)s

Groups:

operational, authenticated, failure, failure-high, ssh

From version:

1.6.0

Description:

None

30017

Message:

Close file "%(path)s" after successful %(mode)s. Read %(total_read)s bytes at %(read_speed)s bytes/second and wrote %(total_write)s bytes at %(write_speed)s bytes/second in %(duration)s seconds.

Groups:

authenticated, success, file-operation, ssh

From version:

1.6.0

Description:

None

Data:
duration:

Total time in seconds for which the file was opened.

mode:

Mode in which the file was opened.

read_speed:

Average bytes / second read.

total_read:

Total bytes read from the file,

total_write:

Total bytes written to the file.

write_speed:

Average bytes / second written.

30018

Message:

Internal error. Failure in the SSH userauth service for "%(username)s". %(details)s

Groups:

authentication, session, failure, failure-critical, ssh

From version:

1.8.1

Description:

None

Data:
username:

Name of the account.

30019

Message:

Listing folder "%(path)s".

Groups:

authenticated, informational, file-operation, ssh

From version:

1.6.0

Description:

None

30020

Message:

Successfully listed folder "%(path)s".

Groups:

authenticated, success, file-operation, ssh

From version:

1.6.0

Description:

None

30021

Message:

Failed to list folder "%(path)s". %(details)s

Groups:

authenticated, failure, file-operation, ssh

From version:

1.6.0

Description:

None

Data:
details:

More details about the failure.

30022

Message:

Deleting "%(path)s".

Groups:

authenticated, informational, file-operation, ssh

From version:

1.6.0

Description:

None

30023

Message:

Successfully deleted "%(path)s".

Groups:

authenticated, success, file-operation, operation-delete, ssh

From version:

1.6.0

Description:

None

30024

Message:

Failed to delete "%(path)s". %(details)s

Groups:

authenticated, failure, file-operation, operation-delete, ssh

From version:

1.6.0

Description:

None

Data:
details:

More details about the failure.

30025

Message:

Renaming "%(from)s" to "%(to)s".

Groups:

authenticated, informational, file-operation, ssh

From version:

1.6.0

Description:

None

Data:
from:

Current file/folder path.

path:

Future file/folder path.

to:

Future file/folder path.

30026

Message:

Successfully rename "%(from)s" to "%(to)s".

Groups:

authenticated, success, file-operation, operation-rename, ssh

From version:

1.6.0

Description:

None

Data:
from:

Old file/folder path.

path:

New file/folder path.

to:

New file/folder path.

30027

Message:

Failed to rename "%(from)s" to "%(to)s". %(details)s

Groups:

authenticated, failure, file-operation, operation-rename, ssh

From version:

1.6.0

Description:

None

Data:
details:

More details about the failure.

from:

Current file/folder path.

path:

New file/folder path.

to:

Future file/folder path.

30028

Message:

Creating folder "%(path)s".

Groups:

authenticated, informational, file-operation, ssh

From version:

1.6.0

Description:

None

30029

Message:

Successfully created folder "%(path)s".

Groups:

authenticated, success, file-operation, operation-create-folder, ssh

From version:

1.6.0

Description:

None

30030

Message:

Failed to create folder "%(path)s". %(details)s

Groups:

authenticated, failure, file-operation, operation-create-folder, ssh

From version:

1.6.0

Description:

None

Data:
details:

More details about the failure.

30031

Message:

Deleting folder "%(path)s".

Groups:

authenticated, informational, file-operation, ssh

From version:

1.6.0

Description:

None

30032

Message:

Successfully delete folder "%(path)s".

Groups:

authenticated, success, file-operation, operation-delete, ssh

From version:

1.6.0

Description:

None

30033

Message:

Failed to delete folder "%(path)s". %(details)s

Groups:

authenticated, failure, file-operation, operation-delete, ssh

From version:

1.6.0

Description:

None

Data:
details:

More details about the failure.

30034

Message:

Getting attributes for "%(path)s".

Groups:

authenticated, informational, file-operation, ssh

From version:

1.6.0

Description:

None

30035

Message:

Successfully got attributes for "%(path)s".

Groups:

authenticated, success, file-operation, ssh

From version:

1.6.0

Description:

None

30036

Message:

Failed to get attributes for "%(path)s". %(details)s

Groups:

authenticated, failure, file-operation, ssh

From version:

1.6.0

Description:

None

Data:
details:

More details about the failure.

30037

Message:

Setting attributes for "%(path)s".

Groups:

authenticated, informational, file-operation, ssh

From version:

1.6.0

Description:

None

30038

Message:

Successfully set attributes for "%(path)s".

Groups:

authenticated, success, file-operation, ssh

From version:

1.6.0

Description:

None

30039

Message:

Failed to set attributes for "%(path)s". %(details)s

Groups:

authenticated, failure, file-operation, ssh

From version:

1.6.0

Description:

None

Data:
details:

More details about the failure.

30040

Message:

Close file "%(path)s" for failed %(mode)s transfer. Read %(total_read)s bytes at %(read_speed)s bytes/second and wrote %(total_write)s bytes at %(write_speed)s bytes/second in %(duration)s seconds.

Groups:

authenticated, failure, failure-specific, file-operation, ssh

From version:

3.40.0

Description:

None

Data:
duration:

Total time in seconds for which the file was opened.

mode:

Mode in which the file was opened.

read_speed:

Average bytes / second read.

total_read:

Total bytes read from the file,

total_write:

Total bytes written to the file.

write_speed:

Average bytes / second written.

30041

Message:

Close file "%(path)s" for failed read transfer. Read %(total_read)s bytes at %(read_speed)s bytes/second in %(duration)s seconds.

Groups:

authenticated, failure, failure-specific, file-operation, operation-read, ssh

From version:

3.40.0

Description:

None

Data:
duration:

Total time in seconds for which the file was opened.

read_speed:

Average bytes / second read.

total_read:

Total bytes read from the file,

30042

Message:

Close file "%(path)s" for failed write transfer. Wrote %(total_write)s bytes at %(write_speed)s bytes/second in %(duration)s seconds.

Groups:

authenticated, failure, failure-specific, file-operation, operation-write, ssh

From version:

3.40.0

Description:

None

Data:
duration:

Total time in seconds for which the file was opened.

total_write:

Total bytes written to the file.

write_speed:

Average bytes / second written.

30043

Message:

Successfully opened "%(path)s" in "%(mode)s" mode, requested as "%(requested_path)s".

Groups:

authenticated, success, file-operation, ssh

From version:

1.6.0

Description:

None

Data:
mode:

Open mode requested for the file

path:

Virtual path of the opened file.

requested_path:

The path as it was requested by the client.

30044

Message:

Failed to open "%(path)s" in "%(mode)s" mode, requested as "%(requested_path)s". %(details)s

Groups:

authenticated, failure, file-operation, ssh

From version:

1.6.0

Description:

None

Data:
mode:

Open mode requested for the file

requested_path:

The path as it was requested by the client.

30045

Message:

Failed to read from file "%(path)s". %(details)s

Groups:

authenticated, failure, file-operation, ssh

From version:

1.6.0

Description:

None

Data:
details:

More details about the failure.

30046

Message:

Failed to write to file "%(path)s". %(details)s

Groups:

authenticated, failure, file-operation, ssh

From version:

1.6.0

Description:

None

Data:
details:

More details about the failure.

30047

Message:

Failed to close file "%(path)s" after opening for %(mode)s. Read %(total_read)s at %(read_speed)s and wrote %(total_write)s at %(write_speed)s in %(duration)s seconds. %(details)s

Groups:

authenticated, failure, failure-high, file-operation, ssh

From version:

1.6.0

Description:

None

Data:
mode:

Mode in which the file was opened.

30048

Message:

SFTP request not supported. %(details)s

Groups:

authenticated, failure, ssh

From version:

5.3.0

Description:

None

30049

Message:

Could not read SSH key received from client. %(details)s

Groups:

authentication, session, failure, ssh

From version:

2.10.0

Description:

None

30050

Message:

Disconnecting the SSH connection. %(details)s

Groups:

authenticated, failure, ssh

From version:

1.8.0

Description:

None

30051

Message:

New client connection denied. Too many concurrent SSH connections.

Groups:

session, failure, failure-specific, ssh

From version:

1.8.0

Description:

None

30052

Message:

Failed to handle SFTP command %(command)s. %(details)s

Groups:

session, failure, failure-critical, ssh

From version:

5.3.0

Description:

None

30053

Message:

Reading link for "%(path)s".

Groups:

authenticated, informational, file-operation, ssh

From version:

2.4.0

Description:

None

30054

Message:

Successfully read link for "%(path)s".

Groups:

authenticated, success, file-operation, ssh

From version:

2.4.0

Description:

None

30055

Message:

Failed to read link for "%(path)s". %(details)s

Groups:

authenticated, failure, file-operation, ssh

From version:

2.4.0

Description:

None

Data:
details:

More details about the failure.

30056

Message:

Making link for "%(path)s".

Groups:

authenticated, informational, file-operation, ssh

From version:

2.4.0

Description:

None

30057

Message:

Successfully made link for "%(path)s".

Groups:

authenticated, success, file-operation, ssh

From version:

2.4.0

Description:

None

30058

Message:

Failed to make link for "%(path)s". %(details)s

Groups:

authenticated, failure, file-operation, ssh

From version:

2.4.0

Description:

None

Data:
details:

More details about the failure.

30059

Message:

Extended requests are not supported by the SFTP protocol.

Groups:

authenticated, failure, failure-specific, ssh

From version:

2.4.0

Description:

None

30060

Message:

Canonical file name requested for "%(path)s".

Groups:

authenticated, informational, file-operation, ssh

From version:

2.4.0

Description:

None

30061

Message:

Failed to get attributes for opened file "%(path)s". %(details)s

Groups:

authenticated, failure, file-operation, ssh

From version:

2.4.0

Description:

None

Data:
details:

More details about the failure.

30062

Message:

Setting attributes on opened files not implemented for "%(path)s".

Groups:

authenticated, failure, file-operation, ssh, failure-specific

From version:

2.4.0

Description:

None

30063

Message:

Fail to send data to peer. Closing SSH session. %(details)s

Groups:

authenticated, failure, failure-critical, ssh

From version:

5.3.0

Description:

None

30064

Message:

SCP session closed.

Groups:

authenticated, informational, ssh

From version:

2.5.0

Description:

None

30065

Message:

Internal error. Failed to process the SCP request. %(details)s

Groups:

operational, authenticated, failure, failure-critical, ssh

From version:

2.5.0

Description:

None

30066

Message:

Failed to process '%(command)s' command request. %(details)s

Groups:

operational, authenticated, failure, failure-critical, ssh

From version:

3.45.0

Description:

None

Data:
command:

Name of the requested command.

30067

Message:

Close file "%(path)s" after successful read. Read %(total_read)s bytes at %(read_speed)s bytes/second in %(duration)s seconds.

Groups:

authenticated, success, file-operation, operation-read, ssh

From version:

3.7.0

Description:

None

Data:
duration:

Total time in seconds for which the file was opened.

mode:

Mode in which the file was opened.

read_speed:

Average bytes / second read.

total_read:

Total bytes read from the file,

30068

Message:

Close file "%(path)s" after successful write. Wrote %(total_write)s bytes at %(write_speed)s bytes/second in %(duration)s seconds.

Groups:

authenticated, success, file-operation, operation-write, ssh

From version:

3.7.0

Description:

None

Data:
duration:

Total time in seconds for which the file was opened.

mode:

Mode in which the file was opened.

total_write:

Total bytes written to the file.

write_speed:

Average bytes / second written.

30069

Message:

Authentication requested for username with invalid encoding "%(username)s".

Groups:

session, failure, ssh, failure-specific

From version:

3.20.0

Description:

None

Data:
username:

Raw value of the requested username.

30070

Message:

Authentication requested with a password with invalid encoding.

Groups:

session, failure, failure-specific, ssh

From version:

3.20.0

Description:

None

30071

Message:

Invalid remote SSH server identity for location %(name)s. Configured "%(expected_fingerprint)s", remote sent "%(actual_fingerprint)s".

Groups:

session, failure, failure-critical, failure-specific, ssh, client-side

From version:

2.9.0

Description:

None

Data:
actual_fingerprint:

Fingerprint received from the remote server.

expected_fingerprint:

Configured fingerprint.

name:

Name of the location associated with this event

30072

Message:

Location %(name)s connected to the SSH server.

Groups:

session, informational, ssh, client-side

From version:

3.0.0

Description:

None

Data:
name:

Name of the location associated with this event

30073

Message:

Connection to SSH server "%(server_version)s" was lost for location %(name)s. Protected using host-key:%(host_key)s key-exchange:%(key_exchange)s in-hmac:%(in_hmac)s in-cipher:%(in_cipher)s out-hmac:%(out_hmac)s out-cipher:%(out_cipher)s

Groups:

session, informational, ssh, client-side

From version:

3.0.0

Description:

None

Data:
host_key:

Host key algorithm in used to identify the server-side.

in_cipher:

Cipher used for received data.

in_hmac:

Hash-based message authentication code for received data.

key_exchange:

Key exchange algorithm used by the connection.

name:

Name of the location associated with this event

out_cipher:

Cipher used for sent data.

out_hmac:

Hash-based message authentication code for sent data.

server_version:

The SSH product detected on the server.

30074

Message:

Ignoring setting attributes for opened file "%(path)s".

Groups:

authenticated, failure, file-operation, ssh, failure-specific

From version:

3.51.0

Description:

None

30076

Message:

Client SFTP started for "%(name)s" using "%(credentials_type)s".

Groups:

authenticated, informational, ssh, client-side

From version:

3.0.0

Description:

None

Data:
credentials_type:

The type of authenticated used. (Since 4.27.0)

name:

Name of the location associated with this event

30077

Message:

Client SFTP subsystem closed for location %(name)s.

Groups:

authenticated, informational, ssh, client-side

From version:

3.0.0

Description:

None

Data:
name:

Name of the location associated with this event

30078

Message:

Failure while authenticating the SFTP client for "%(name)s" using methods: %(methods)s. %(details)s

Groups:

operational, session, ssh, failure, failure-high, client-side

From version:

3.0.0

Description:

None

Data:
methods:

List with all methods tried to authenticate.

name:

Name of the location which failed at the authentication process.

30079

Message:

SSH Banner received: %(message)s

Groups:

session, informational, ssh, client-side

From version:

3.29.0

Description:

None

Data:
message:

The message sent by the server.

30080

Message:

SSH rekey successfully completed.

Groups:

session, informational, ssh, client-side

From version:

3.31.0

Description:

None

30081

Message:

Successfully got attributes for opened file "%(path)s".

Groups:

authenticated, informational, file-operation, ssh

From version:

3.51.0

Description:

None

30082

Message:

Remote client disconnected %(code)s:%(details)s.

Groups:

authenticated, informational, ssh

From version:

5.0.0

Description:

None

30083

Message:

Remote server disconnected %(code)s:%(details)s.

Groups:

authenticated, informational, ssh, client-side

From version:

5.0.0

Description:

None