topic FTP Logging in Operating System - HP-UX

FTP Logging

Anthony Alvarez_1 — Thu, 27 Feb 2003 22:41:12 GMT

I know this has to be really basic, and apologies for the question, but I couldn't find it elsewhere in the forum, so apologies if this is a FAQ.

Could you kindly share your experience with me?

How can FTP be configured to create a access and error log file? We need to find out who has been using FTP and when.

We are using HPUX v10.20's built in FTP.
Any clues, suggestions, tips or advise are greatly appreciated. Please advise.

I look forward to hearing from you. Thanks in advance.

Re: FTP Logging

Paul Sperry — Thu, 27 Feb 2003 22:47:33 GMT

By default all ftp logging is done in /var/adm/syslog/syslog.log

Re: FTP Logging

Steven E. Protter — Thu, 27 Feb 2003 22:54:33 GMT

ftp logging is for inbound, not inbound.

HP-UX uses Washington University's free ftp server

For enhanced logging

vi /etc/inetd.conf

the line that says ftpd add a -l (dash letter lower case L)

save the file

inetd -c

enhanced logging is in place.

SEP

Re: FTP Logging

Ian Kidd_1 — Thu, 27 Feb 2003 22:55:35 GMT

some of the more advanced logging options for the ftpd is found only on 11.00 and higher. with that version you can set it up so that there is an addional log file for ftp.

But I don't believe those options exist on 10.20. All you have is the -v option:

(1) modify /etc/inetd.conf to use the -v option:
ftp stream tcp nowait root /usr/lbin/ftpd ftpd -lv

(2) recycle the internet services daemon:
/usr/sbin/inetd -c

you should then get more info put into your syslog

Re: FTP Logging

Greg Geyer — Thu, 27 Feb 2003 22:56:24 GMT

check the man page for ftpaccess. There is some logging to the /var/adm/syslog/syslog.log by default, but for indepth logging (which will go to /var/adm/syslog/xfer.log) use the log transfers and log commands line items in the config file.

Re: FTP Logging

Ian Kidd_1 — Thu, 27 Feb 2003 23:11:57 GMT

I posted a few minutes ago about the -v option for the ftpd daemon. Here's some actual data that I pulled from a 10.20 system:

This is the output of ftpd -lv:
Feb 24 20:14:20 sarena01 ftpd[17081]: FTP LOGIN FROM sarena01, ikidd
Feb 24 20:14:22 sarena01 ftpd[17081]: PORT
Feb 24 20:14:31 sarena01 ftpd[17081]: PORT
Feb 24 20:14:31 sarena01 ftpd[17081]: FTP: retrieve slck
Feb 24 20:14:32 sarena01 ftpd[17081]: User ikidd logged out

It shows login/logout times as well as the fact that I retrieved (get) the file slck.

Re: FTP Logging

T G Manikandan — Fri, 28 Feb 2003 03:48:13 GMT

Make sure that you add -l in the /etc/inetd.conf file
like
ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l

ALso make sure that you have /etc/syslog.conf

local5.debug /var/adm/syslog/syslog.log

if you do not have then add it and then do a
kill -HUP `cat /var/run/syslog.pid`

to re-read the syslog.conf file