Using truss I was able to determine that the daemon was looking for 'conslog' and not 'log' ./dev/null ./dev/conslog sftp now logs to /var/adm/openssh.log Thanks to all for your suggestions Cheers
Using truss I was able to determine that the daemon was looking for 'conslog' and not 'log' ./dev/null ./dev/conslog sftp now logs to /var/adm/openssh.log Thanks to all for your suggestions Cheers