How to know what app is being used for file transfer?

Linux and Unix-Like Ubuntu
1

Hi

I have a Ubuntu box that one of our system admins transfers log files to.
I want to find out how the transfer of the file is done. That is whether he is pushing the
files with an app such as rsync or scp to the Ubuntu box or he is pulling the files from where it is to the Ubuntu box. I only have access to the Ubuntu box and dont have any access to where the files are remotely.

Thanks for suggestions and help.

2

You could check his shell history, perhaps. ~/.bash_history if he uses the bash shell

3

I checked ~/.bash_history but no commands there show any transfer of files.

I can see from auth.log what user he logs in as and the opening of ssh sessions and from which IP he is connecting from.

4

Check for 'subsystem request for sftp' in that log.

5

I do not get anything for 'subsystem request for sftp' when i check for it in the auth.log file

6

the admin is probaly just using scp ... or it can be tar over ssh ...