How does bash/scp expand out "remote" glob patterns?

Question

If I execute (in bash):

scp remote.machine:/var/log/sy* .

I get all the files which match /var/log/sy* on the remote machine.

syslog                                     100%   91KB  10.1KB/s   00:09    
syslog.1                                   100%  753KB  62.7KB/s   00:12    
syslog.2.gz                                100%   55KB   7.9KB/s   00:07    
syslog.3.gz                                100%   50KB   8.3KB/s   00:06   

How can this work?

I was under the impression that glob patterns were expanded by the shell before the command was executed.

Is my understanding incorrect?

Answer 1

Your understanding is correct. But:

Your local shell cannot expand remote.machine:/var/log/sy*, because you don't have such a file (probably; a directory remote.machine: in the current folder with the sub directory tree var/log/ containing sy* files is very rare.

So your shell gives the string to scp unexpanded, which hands it over to the remote system, which parses and uses it.