ftp daemon writing to syslog

[Tim Killinger]

HPUX 11.0

how do you stop the ftp daemon from writing informational messages to syslog.log?

Example:Feb 11 14:48:45 icgstx1 ftpd[27959]: icgroute of 112.64.85.9 [112.64.85.9] delet
ed /opt/app/data/dgn/tx8670/di0509b.wrk


Thanks!

[Sridhar Bhaskarla]

Hi,

Look at your /etc/inetd.conf and search for ftpd. Make sure it is not enabled with -l option. If so, delete it and restart inetd with "inetd -c".

Then try ftp and see if it prints those mess
ages again.

-l for session logging
-v for debugging information

'man ftpd' for more information.

-Sri

[Sridhar Bhaskarla]

Hmmm... one more.. Search for another option "-L" also.

-Sri

[Tim Killinger]

the only line in inetd.conf refering to ftpd:

ftp stream tcp nowait root /usr/lbin/ftpd ftpd -u 111


no use of -l or -L

[Steven E. Protter]

Its kind of all or nothing.

enhanced logging can be toggled with the command inetd -l

Its like a light switch. I know of no way to discriminate by protocol.

Probably possible in syslogd.conf

Or is that Linux?

No, I am attaching mine. You may be able to manipulate this to direct ftp output to a separate file.

SEP

[Jeroen Peereboom]

L.S.

Indeed it's all or nothing.

But isn't it strange to see all these ftp messages in syslog?

* Has the inetd.conf file been changed recently without re-starting inetd?

* Do you have a /etc/ftpd/ftpaccess file?
According to the ftpd man-page logging may be specified there too.

HTH,

JP.

[Steve Longenecker · Accepted solution]

Tim, try the following...

HOWTO redirect ftp syslog entries from syslog.log to an ftp.log

change /etc/syslog.conf from:

mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *

to:

mail.debug /var/adm/syslog/mail.log
*.info;mail.none;local5.none /var/adm/syslog/syslog.log
local5.info;mail.none /var/adm/syslog/ftp.log
*.alert /dev/console
*.alert root
*.emerg *

then bounce syslogd using:

# sbin/init.d/syslogd stop
# sbin/init.d/syslogd start

-or-

# kill -HUP `cat /var/run/syslog.pid`

NOTE: Use not