topic Re: inetdand ftpd logs pollute my syslog in Operating System - HP-UX

inetdand ftpd logs pollute my syslog

marc seguin — Tue, 15 Oct 2002 09:55:49 GMT

Hello,

I have ftp connections every five minutes on a server and 2 messages are added in syslog.log every time :
Oct 15 12:23:45 hawking telnetd[7136]: getpid : peer died: Error 0
Oct 15 12:23:45 hawking ftpd[7137]: connection from admin2 at Tue Oct 15 12:23:45 2002

How can I redirect to another file these messages which pollute my syslog.log, in order to keep interesting messages ?

Thanks

Re: inetdand ftpd logs pollute my syslog

Stefan Farrelly — Tue, 15 Oct 2002 10:09:17 GMT

You can stop the ftp messages going to syslog one of 2 ways;

1. Remove the -L option form /etc/inetd.conf on the ftpd line.
2. In /etc/syslog.conf change;
*.info;mail.none /var/adm/syslog/syslog.log
To
*.info;mail.none;ftpd.none /var/adm/syslog/syslog.log

Then restart syslog.

But I dont think you can redirect ftp log messages to somewhere else apart from syslog. According to the manpage for ftpd they can only be logged to syslog and ive tried modifying the /etc/syslog.conf file to redirect ftp messages to a different log but it doesnt work - fptd must be writing direct to syslog.log itself (not via syslog daemon) so youre out of luck on redirecting im afraid.

Re: inetdand ftpd logs pollute my syslog

Paula J Frazer-Campbell — Tue, 15 Oct 2002 10:30:06 GMT

Hi

This entry:-

Oct 15 12:23:45 hawking telnetd[7136]: getpid : peer died: Error 0

is not from an ftp but from a telnet connection being dropped as oposed to closed.

Paula

Re: inetdand ftpd logs pollute my syslog

Paula J Frazer-Campbell — Tue, 15 Oct 2002 10:51:07 GMT

Soorty I have reread your question.

As has been said a redirect is not possible but !!!

Cron a job to do :-

cat /var/adm/syslog/syslog.log | grep ftpd > /var/adm/syslog/sys_ftp.log
cat /avar/adm/syslog/syslog.log | grep -v ftpd > /var/adm/syslog/syslog.clean
cp /var/adm/syslog/syslog.log /var/adm/syslog.bak
mv /var/adm/syslog/syslog.clean /var/adm/syslog/syslog.log

Or you could keep this as a script and run it as and when.

HTH
Paula

Re: inetdand ftpd logs pollute my syslog

Paula J Frazer-Campbell — Tue, 15 Oct 2002 10:51:35 GMT

With out the Typos

Sorry I have reread your question.

As has been said a redirect is not possible but !!!

Cron a job to do :-

cat /var/adm/syslog/syslog.log | grep ftpd > /var/adm/syslog/sys_ftp.log

cat /var/adm/syslog/syslog.log | grep -v ftpd > /var/adm/syslog/syslog.clean
cp /var/adm/syslog/syslog.log /var/adm/syslog.bak

mv /var/adm/syslog/syslog.clean /var/adm/syslog/syslog.log

Or you could keep this as a script and run it as and when.

HTH
Paula

Re: inetdand ftpd logs pollute my syslog

Paula J Frazer-Campbell — Tue, 15 Oct 2002 11:38:25 GMT

Marc

Also see:-

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x4765c1c4ceddd61190050090279cd0f9,00.html

And pay attention to Darrell's post.

Paula

Re: inetdand ftpd logs pollute my syslog

marc seguin — Tue, 15 Oct 2002 12:19:02 GMT

Yes, it looks as is not possible.

The entry ftpd.* is not accepted in syslog.conf (I checked it with syslogd -d)

ftp logs are logs among all daemon logs.
And it's a "All or nothing" choice !

So I just wrote a script to clean logs when needed :

if [[ -n "$1" && -r "$1" ]]; then
SYSLOG=$1
else
SYSLOG=/var/adm/syslog/syslog.log
fi

cat $SYSLOG | grep -v -e "hawking telnetd\[[0-9]*\]: getpid : peer died: Error 0$" -e "hawking ftpd\[[0-9]*\]: connection from admin2 at"

Thanks for your help understanding the syslog.conf file.

Re: inetdand ftpd logs pollute my syslog

Jordan Bean — Tue, 15 Oct 2002 15:59:52 GMT

ftpd logs to LOCAL5. Redirect that to another file.

inetd logs to DAEMON. I'm not sure to where telnetd sends its logs.

Re: inetdand ftpd logs pollute my syslog

marc seguin — Wed, 16 Oct 2002 08:45:30 GMT

local5 redirection doesn't include ftpd messages on my system (HP-UX 10.20).
Perhaps it is valid for HP-UX 11...