topic syslog.log is getting too big in Operating System - HP-UX

syslog.log is getting too big

Simon R Wootton — Mon, 04 Aug 2003 12:42:20 GMT

My syslog.log grows at an alarming rate and makes important messages difficult to find. The reason is thousands of FTP messages (we use ftp alot!). I need to stop these messages (and other irrelevent messages) from hitting the syslog.

I believe there is a parameter in /etc/inetd.conf for ftp to do with logging (-l option ?) but wondered if this was the best option and what else is available to properly monitor the syslog.

All help is rewarded !

Thankyou
Simon

Re: syslog.log is getting too big

harry d brown jr — Mon, 04 Aug 2003 12:45:19 GMT

You could remove the "-l" option from your ftpd line in /etc/inetd.conf. But then you won't have any logging (security issue??).

live free or die
harry

Re: syslog.log is getting too big

Steven E. Protter — Mon, 04 Aug 2003 12:49:41 GMT

logging is a good thing.

Once a week, cron does the following things for my on syslog

cp /var/adm/syslog/syslog.log /backups/syslog.log

gzip /backups/syslog.log

> /var/adm/syslog.log

logging is your first defense against hackers, I urge you to leave it on.

SEP

Re: syslog.log is getting too big

Brian Bergstrand — Mon, 04 Aug 2003 12:49:58 GMT

Or reconfig your /etc/syslog.conf file so all FTP messages go to a different file. I'm not sure what level ftpd logs at.

Re: syslog.log is getting too big

Mark Greene_1 — Mon, 04 Aug 2003 12:51:51 GMT

You could add a line to /etc/syslog.conf:

*.daemon /var/adm/syslog/daemon.log

This will write all the ftp messages to the daemon.log file. There will also be other messages from other daemon processes so you'll still have to sort through it, but it will make reading through the actual syslog.log file easier.

HTH
mark

Re: syslog.log is getting too big

James R. Ferguson — Mon, 04 Aug 2003 12:52:14 GMT

Hi SImon:

If 'ftpd' messages are a problem, drop the '-L' option from the 'etc/inetd.conf' spawn of the 'ftpd' daemon [and restart 'inetd'] or configure the 'etc/ftp/ftpaccess' file to specify a location for messages other than 'syslog'. See the man pages for 'ftpd(1M)' and 'ftpaccess(4)' for more details. Specifically note the 'log syslog+xferlog' option in 'ftpaccess'

Regards!

...JRF...

Re: syslog.log is getting too big

Stefan Farrelly — Mon, 04 Aug 2003 12:53:53 GMT

Just redirect ftp log messages to their own logfile, do it in /etc/syslog.conf

# @(#) $Revision: 74.1 $
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
local5.info;mail.none /var/adm/syslog/ftp.log
mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *

You can point the ftp.log anywhere you want, doesnt have to be in /var if youre having space issues. We back ours up weekly then cp /dev/null to them.

Re: syslog.log is getting too big

Simon R Wootton — Mon, 04 Aug 2003 12:56:05 GMT

Guys - Thankyou all - Problem will be sorted within the hour !

Re: syslog.log is getting too big

Brian Bergstrand — Mon, 04 Aug 2003 12:59:37 GMT

This mod to syslog.conf should work, but I haven't tested it. Note: This will seperate anything that logs under the daemon facility, not just FTP.

HTH.

8c8,9
< *.info;mail.none /var/adm/syslog/syslog.log
---
> *.info;mail.none;daemon.none /var/adm/syslog/syslog.log
> daemon.* /var/adm/syslog/daemon.log