On Linux systems,
/var/log/secure (or similar, depending on distro) shows all SSH login activity. Is there a similar log for SCP? If not, what's a good approach to enabling logging of scp activity on my servers? Is it SELinux through /var/log/audit/audit.log?
You need to adjust your sshd logging level to DEBUG in order to see scp client connections.
Look at the
/etc/ssh/sshd_config for the "LogLevel" directive.
scp -o LogLevel for testing.
SCP uses SSH connections to transfer files, so SCP logins should appear in the same logs alongside SSH logins. From the man pages:
scp copies files between hosts on a network. It uses ssh(1) for data transfer, and uses the same authentication and provides the same security as ssh(1).