Login and logout for SFTP is in /var/log/secure, but it would assist in troubleshooting if we could also see the commands issued. There are a few possible approaches to this. Two found via google search are:
SFTP logging support for my users with noshell
As a Server Administrator, I want SFTP logging support for my users with noshell, so that I can keep logs of sftp on noshell users.
This feature is looking to log SFTP activity that occurs via noshell (when people are connected for SFTP but have been assigned no shell access via WHM)
This is a feature that has been migrated over from the cPanel Forums. All previous comments and discussions concerning this feature can be located at: