SFTPGo SFTPGo Integration

TL;DR

Overview

SFTPGo is a full-featured, open-source SFTP/FTP/WebDAV server supporting multiple storage backends (local filesystem, S3, Google Cloud Storage, Azure Blob) and database-backed user management (PostgreSQL, MySQL, and others). It emits structured JSON logs covering both internal diagnostics and client-facing activity. This integration ingests SFTPGo's internal "app log" variant, which captures background operations such as cache refreshes and event-rule reloads performed by internal components (e.g., the data provider and event manager). While these logs are primarily useful for confirming service health and background job execution, integrating them into Hunters provides visibility into the operational state of the SFTPGo service as part of a broader file-transfer security monitoring strategy.

Supported data types

SFTPGo Application Logs

Table name: sftpgo_application_logs

This data type contains internal diagnostic log entries emitted by SFTPGo's own components (such as dataprovider_postgresql and eventmanager), including events like user cache checks and event-rule reload cycles. These logs carry limited direct security signal compared to SFTPGo's transfer, connection-failed, or httpd log variants, but are useful for confirming that background services are running and updating as expected.

Expected format

Logs are expected in JSON format.

{"level":"debug","time":"2026-05-19T07:59:07.001","sender":"dataprovider_postgresql","message":"start user cache check, update time 2026-05-19 07:49:07.035 +0000 UTC"}

Send data to Hunters

Hunters supports the collection of SFTPGo logs using Amazon S3.

To connect SFTPGo logs:

1. Configure SFTPGo to write its application logs to a location that can be forwarded or synced into an AWS S3 bucket. Refer to the SFTPGo logs documentation for details on configuring log output.
2. Route the SFTPGo application logs into an AWS S3 bucket.
3. Once logs are in S3, follow the steps in this section to connect the bucket to Hunters.