topic Re: ftp log in Operating System - HP-UX

ftp log

Joseph Bague — Tue, 19 Nov 2002 03:03:49 GMT

How can I enable ftpd logging

Re: ftp log

John Poff — Tue, 19 Nov 2002 03:05:30 GMT

Hi,

In your /etc/inetd.conf config file, find the line for your ftpd daemon and add a '-l' at the end of it. The '-l' option will log all the ftp sessions in the /var/adm/syslog/syslog.log file. If you want to see all the individual ftp commands from each session, use the '-L' option instead, but be warned, if you have a lot of ftp traffic it will put lots of entries in your syslog.log file.

JP

Re: ftp log

Michael Tully — Tue, 19 Nov 2002 03:09:29 GMT

If you wanted to segregate your 'ftp' from your normal system messages, you could output them elsewhere.

Add this entry to your /etc/syslog.conf file at or near the top

daemon.notice /var/adm/syslog/daemon.log

Doing this will, reroute logging for ftp (and all the daemon processes started by inetd and a few others) to this file. Not the the complete segregation of ftp, but places them elsewhere.

Re: ftp log

John Poff — Tue, 19 Nov 2002 03:10:16 GMT

Oops. Almost forgot. After updating your inetd.conf file, you'll need to do a:

inetd -c

to get the inetd daemon to re-read the inetd.conf file and pick up on your ftpd change.

JP

Re: ftp log

Michael Tully — Tue, 19 Nov 2002 03:10:27 GMT

By default 'ftp' has logging enabled, and it places the entries into the system log (/var/adm/syslog/syslog.log)

To check if it enabled, have a look in your '/etc/inetd.conf' file.
The entry should look like this:

ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l

if it is not, then change the entry and restart 'inetd'
# inetd -c

Re: ftp log

Joseph Bague — Tue, 19 Nov 2002 03:14:15 GMT

in logging it will include the ip address of the ftp client?

Re: ftp log

John Poff — Tue, 19 Nov 2002 03:31:34 GMT

Joseph,

I'm pretty sure the IP address [or the hostname if it can be resolved] is included in the log.

Michael, thanks for the info on redirecting the ftp log entries. I've been wondering how to do that.

JP