Okta Advanced Server Access Mac Client Logs Write to an Unexpected Directory

The Okta Advanced Server Access (ASA) and Okta Privileged Access (OPA) Mac client writes logs to an unexpected directory when a third-party tool invokes an sft operation from a shell context without a defined home directory. Resolve this issue by identifying the third-party tool or operation invoking the command and adjusting its configuration to include a home directory.

The ScaleFT Mac client normally writes logs to the /Users/<username>/Library/Logs/ScaleFT directory. In certain situations, the client writes logs to a different, unexpected relative path based on where the tool invokes the sft operation:

<username>@<client> sft % pwd
/Users/<username>/Downloads/testdir/Library/Logs/ScaleFT/sft
<username>@<client> sft % ls -lah
total 8
drwxr-xr-x  3 <username>  <group>    96B Oct 10 15:11 .
drwxr-xr-x  3 <username>  <group>    96B Oct 10 15:11 ..
-rw-r--r--  1 <username>  <group>   889B Oct 10 15:11 sft-2025-10-10T15_11_31-07_00.log
<username>@<client> sft % cat sft-2025-10-10T15_11_31-07_00.log
2025-10-10T15:11:31.759-0700 INFO sft command {"log_directory": "Library/Logs/ScaleFT/sft", "version": "1.98.1", "pid": 58919, "args": ["/usr/local/bin/sft", "resolve", "-q", "<servername>"]}
2025-10-10T15:11:31.774-0700 DEBUG macOS User Defaults check returned error {"error": "exit status 1"}
2025-10-10T15:11:31.775-0700 DEBUG Did not load a config from file, using default values {"path": "Library/Application Support/ScaleFT/sft.conf", "error": "stat Library/Application Support/ScaleFT/sft.conf: no such file or directory"}
2025-10-10T15:11:31.775-0700 ERROR CLI Action failed {"error": "", "action": "resolve"}
2025-10-10T15:11:31.775-0700 INFO RecordSpan {"traceID": 3454098685175981815, "spanID": 2341933501568423439, "tags": {"error":true}, "t": "trace", "operation": "cli.resolve", "start": "2025-10-10T15:11:31.775-0700", "duration": "149.958µs"}

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Advanced Server Access (ASA)
• Okta Privileged Access (OPA)
• Mac Client

The Mac ScaleFT client parses the home directory from the shell environment to use as the base path for writing logs. If a tool invokes an sft operation from a shell context that lacks a defined home directory, the client fails to create the path relative to the home directory. Instead, the client writes the logs to a relative path from where the tool invoked the operation.

This behavior occurs when an administrator configures a proxy command, which causes the system to invoke sft for standard Secure Shell (SSH) operations, and a third-party tool, such as Visual Studio Code (VSCode), attempts to SSH to a server from a shell context without a home directory.

The example in the Overview section reproduces by configuring a proxy command and running an SSH operation from the testdir path with a command that sets an empty HOME variable during execution:

/usr/bin/env -i PATH="/usr/local/bin:/usr/bin:/bin" HOME= CFFIXED_USER_HOME= /usr/bin/ssh -vvv -F "$HOME/.ssh/config" <servername>

How is the unexpected log directory issue resolved?

Identify the operations or third-party tools invoking sft commands without a home directory and adjust their configurations by following these steps.

1. Evaluate which operations or third-party tools invoke sft commands from a shell context without a home directory.
2. Adjust the configuration of the identified tool or operation. For example, if a Visual Studio Code (VSCode) Secure Shell (SSH) operation using a proxy command triggers this behavior, and that invocation is unwanted, adjust the VSCode configuration to prevent it or to include a home directory.