ETW logging doesn't work for non-admin accounts

[julien-padovani]

"OpenSSH for Windows" version
OpenSSH_for_Windows_7.7p1, LibreSSL 2.6.4

Server OperatingSystem
Windows Server 2012 R2 Datacenter

Client OperatingSystem
Windows 10

What is failing
Once client is connected to sftp-server, there is no visible actions in logs.
Exemple, a user remove a file or folder, no logs show this.

Expected output
Get detailled logs about the user actions - create/delete/rename/move

Get logs in Event viewer from sftp-server

Get logs in file from sftp-server

Actual output
sshd provides logs about the ssh connection
sftp-server provides no information in logs about users actions.

Current SSHD_CONFIG
#Logging
SyslogFacility AUTH
#SyslogFacility LOCAL0
LogLevel DEBUG3

#Override default of no subsystems
#Subsystem sftp sftp-server.exe
#Subsystem sftp sftp-server.exe -f LOCAL0 -l DEBUG3
Subsystem sftp sftp-server.exe -f AUTH -l DEBUG3

I have missed something?

Regards

[manojampalam]

Did you follow these 3 steps in https://github.com/PowerShell/Win32-OpenSSH/wiki/Logging-Facilities (referenced in sshd_config manual)

To see Debug logs in EventViewer, do the following:

• Ensure sshd_config has logging level at DEBUG or above
• In Eventviewer, select option to show "Analytic and Debug Logs" (under top menu, View)
• Enable Debug logging (select Debug channel, click "Enable log" on right menu)

[julien-padovani]

Hello,

Yes, I did. When enabled I find detailed information when the user establish the connexion. But I see no logs about files or user actions.

[manojampalam]

Looks like its only working for admin accounts. Thanks for catching this. We'll follow up.

[julien-padovani]

I've added the user to administrators group, I still see no logs about files that the user create/remove/etc...

What results do you see as admin? Could you share your logs?

[bingbing8]

Currently user should be able to see non-admin logs in Debug channel. The Admin and Operational channel are on by default, so setting custom isolation would adds 2 more independent autologgers on the system.
PowerShell/openssh-portable@fc6d825

[kesadae11]

Hello!
When it is planned to solve this Issue? I have the same problem like here: #1615
Do you have any information about it?

Thank you!

[bagajjal]

The fix is part of V8.6 release

PowerShell/openssh-portable#513