Creating a FTP log

[TheJuiceman]

Hey gang,

Is there a way to have all of the FTP information that populates the syslog go to a separate "ftp" log? As always, your help is very appreciated!!!

[Bill Hassell · Accepted solution]

Yes. It isn't documented very well but ftpd sends it's information using the local5 facility name. So you change /etc/syslog.conf from this:

*.info;mail.none /var/adm/syslog/syslog.log

to:

*.info;mail.none;local5.none /var/adm/syslog/syslog.log
local5.info /var/adm/syslog/ftp.log

Then tell syslogd to reread the config file:

kill -HUP $(cat /var/run/syslog.pid)

Now, a new logfile called ftp.log will have all the ftp details. This concept can be extended to other logs:

*.info;mail.none;local5.none;auth.none /var/adm/syslog/syslog.log
auth.info /var/adm/syslog/auth.log
local5.info /var/adm/syslog/ftp.log

which will log authentication details into auth.log and ftpd into ftp.log. Now syslog will be much easier to read.

[TheJuiceman]

Perfect!!! Thank you so much!!!