topic Re: ftp sessions log in Operating System - HP-UX

ftp sessions log

shashang — Sat, 15 May 2004 03:12:45 GMT

hello guys,
I am using unix tru64 4.0f. Is there any way in which I can record the ftp session connecting my server along with the user id.
Thanx in anticipation.

shashang.

Re: ftp sessions log

Bharat Katkar — Sat, 15 May 2004 03:41:23 GMT

As far as i know there is no special file for FTP log. You have to edit syslog file for this.

This is what i will do on HPUX M/c.
(Go thr SAM, go to syslog viewer and user Filter to get the FTP related log from syslog.log file.)

See if you can do same thing on TRU64.4

Hope this helps you out.

Re: ftp sessions log

G. Vrijhoeven — Sat, 15 May 2004 15:08:40 GMT

Hi,

This is the HPUX forum and not the Tru64 forum. So if i am not correct, i have an excuse....

the ftpd is spawned by the inetd, to alter the logging of that deamon you will have to edit the /etc/inetd.conf. There should be a line that has ftpd in it. Alter that line so the ftpd is started in debugging mode. ftpd -dl
In addition to that you can alter the /etc/syslog.conf so all ftp warnings are logged. ( check man pages for exact syntax please)

HTH,

Gideon

Re: ftp sessions log

Michael Schulte zur Sur — Sat, 15 May 2004 15:28:09 GMT

Hi,

you may want to add -dl to the ftpd entry in /etc/inetd.conf. Then do a kill -HUP on the inetd and you should have a log of ftp activity including user and commands in /var/adm/syslog.dated/current/daemon.log or user.log.

hth,

Michael

Re: ftp sessions log

Joseph Loo — Sun, 16 May 2004 19:45:14 GMT

hi,

at /etc/inetd.conf, look for the ftp line. at the end of the line, default is "ftpd -l". replace it with "ftp -oil" and do this to re-start inetd:

# inetd -c

this will generate a log file, xferlog under the directory, /var/adm/syslog/

however, take note that -o option is overriden by the /etc/ftpd/ftpaccess file.

regards.

Re: ftp sessions log

Edwin Dikhooff — Mon, 17 May 2004 02:09:09 GMT

Hi,

In HPUX, using the option -l -a at the ftpd line within the inetd.conf you force ftpd to use the ftpaccess file in /etc/ftpd.
In this file you can specify what to log with the line:
log transfers real inboud,outbound

All loggings are placed in /var/adm/syslog/xferlog

The ftpaccess file can also enable access lists for ftpsessions from networks/hosts, block specific files for ftp.
For more details check the man pages for the correct syntax.

Hopes this helps you on your way.

Edwin

Re: ftp sessions log

Mobeen_1 — Mon, 17 May 2004 02:13:06 GMT

Shashang,
There are various means to accomplish what you are looking for. Perhaphs the 2 discussion threads below give you all the information that you are looking for

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=187078

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=96479

regards
Mobeen

Re: ftp sessions log

shashang — Mon, 17 May 2004 05:18:54 GMT

thanx michael schulte, giving kill -HUP solved my problem. Can u explain what does kill -1 (HUP) does. As only putting the -l flag in the inetd.conf file did not work.

Re: ftp sessions log

shashang — Mon, 17 May 2004 05:22:29 GMT

thanx michael schulte, giving kill -HUP solved my problem. Can u explain what does kill -1 (HUP) does. As only putting the -l flag in the inetd.conf file did not work. Also is there any way in which i can create a seperate file to log these ftp entries.

Re: ftp sessions log

Joseph Loo — Mon, 17 May 2004 05:27:28 GMT

hi,

have you try, adding "ftp -oil" to the end of the line for ftpd in the inetd.conf file?

as for what HUP means:
# kill -HUP
is equivalent to doing
# inetd -c
to restart the process.

regards.

Re: ftp sessions log

Michael Schulte zur Sur — Mon, 17 May 2004 09:21:49 GMT

Hi,

editing the inetd.conf doesn't do you any good because the inetd is not aware of any change. kill -HUP forces it to reread the conf file.

greetings,

Michael

Re: ftp sessions log

Michael Schulte zur Sur — Mon, 17 May 2004 09:24:08 GMT

Well,

overlooked the question in the second post of you. Could you please explain, what you want exactly?

thanks,

Michael

Re: ftp sessions log

shashang — Tue, 18 May 2004 04:51:11 GMT

Michael, the ftp session entries are created in /var/adm/syslog.dated/current/daemon.log file along with other entries. Is there any way in which I can change the path only for the ftp entries i.e logging the ftp entries in a diff. file?

Regards,
shashang.