ScaleFT Mac Client Logs Write to an Unexpected Directory

The ScaleFT Mac client normally writes logs to the /Users/<username>/Library/Logs/ScaleFT directory. In certain situations, logs may be written to a different, unexpected directory. For example, logs might be found in a relative path based on where the sft operation is invoked:

<username>@<client> sft % pwd
/Users/<username>/Downloads/testdir/Library/Logs/ScaleFT/sft
<username>@<client> sft % ls -lah
total 8
drwxr-xr-x  3 <username>  <group>    96B Oct 10 15:11 .
drwxr-xr-x  3 <username>  <group>    96B Oct 10 15:11 ..
-rw-r--r--  1 <username>  <group>   889B Oct 10 15:11 sft-2025-10-10T15_11_31-07_00.log
<username>@<client> sft % cat sft-2025-10-10T15_11_31-07_00.log 
2025-10-10T15:11:31.759-0700	INFO	sft command	{"log_directory": "Library/Logs/ScaleFT/sft", "version": "1.98.1", "pid": 58919, "args": ["/usr/local/bin/sft", "resolve", "-q", "<servername>"]}
2025-10-10T15:11:31.774-0700	DEBUG	macOS User Defaults check returned error	{"error": "exit status 1"}
2025-10-10T15:11:31.775-0700	DEBUG	Did not load a config from file, using default values	{"path": "Library/Application Support/ScaleFT/sft.conf", "error": "stat Library/Application Support/ScaleFT/sft.conf: no such file or directory"}
2025-10-10T15:11:31.775-0700	ERROR	CLI Action failed	{"error": "", "action": "resolve"}
2025-10-10T15:11:31.775-0700	INFO	RecordSpan	{"traceID": 3454098685175981815, "spanID": 2341933501568423439, "tags": {"error":true}, "t": "trace", "operation": "cli.resolve", "start": "2025-10-10T15:11:31.775-0700", "duration": "149.958µs"}

• Advanced Server Access (ASA) and Okta Privileged Access (OPA)
  • Mac Client

The Mac ScaleFT client parses the home directory from the shell environment to use as the base path for writing logs. If an sft operation is invoked from a shell context that does not have a home directory defined, the path is not created relative to the home directory. Instead, the logs are written to a relative path from where the operation was invoked.

This behavior can occur when proxycommand is configured (causing sft to be invoked for standard Secure Shell (SSH) operations) and a third-party tool, such as Visual Studio Code (VSCode), attempts to SSH to a server from a shell context without a home directory.

The example in the Overview section was reproduced by configuring proxycommand and running an SSH operation from the testdir path with a command that sets an empty HOME variable during execution:

/usr/bin/env -i PATH="/usr/local/bin:/usr/bin:/bin" HOME= CFFIXED_USER_HOME= /usr/bin/ssh -vvv -F "$HOME/.ssh/config" <servername>

1. Evaluate which operations or third-party tools are invoking sft commands from a shell context without a home directory.

2. Once identified, adjust the configuration of that tool or operation. For example, if this is triggered by a Visual Studio Code (VSCode) Secure Shell (SSH) operation using proxycommand, and that invocation is not desired, adjust the VSCode configuration accordingly.