Ftp log file

[Achilles_2]

hi all,

Is there any log file when what the files get or put after using ftp.

Thanks

[Gary L. Paveza, Jr.]

If you log ftp traffic (check /etc/inetd.conf to see if ftpd has the -l option), it is logged to /var/adm/syslog/syslog.log).

[Bill Hassell]

You can turn of detailed ftp logging on the server by modifying /etc/inetd.conf, the ftpd line as follows:

ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l -u 027 -i -o

The -l will log in syslog but the input and output logs will be found in the same directory (/var/adm/syslog/) in the file: xferlog. See the man page for xferlog.

[Bill Hassell]

And be sure to signal inetd that changes have been made to inetd.conf:

inetd -c

[Gary L. Paveza, Jr.]

Bill,

My understanding is that -1 turns on the logging (and goes to /var/adm/syslog/syslog.log), but if you use the -i it logs all incoming files to the /var/adm/syslog/xferlog. -o logs all outgoing files to /var/adm/syslog/xferlog. If you do not do the -o or -i all transfers (and cd's etc) go to /var/adm/syslog/syslog.log.

[Jan Sladky]

Hi Achilles,

you should find it in /var/adm/syslog/syslog.log

or according to Gary's options in

/var/adm/syslog/xferlog ;-)

rgds Jan

[HGN]

Hi

As others have mentioned here to track the ftp the log option need to be enabled on the /etc/inetd.conf file with a -l option and it will write on /var/adm/syslog/syslog.log.

Rgds

HGN

[Bill Hassell]

The -l option logs authentication and session start/stop times but does not log actual filenames that were transferred. You can easily test this by changing inetd.conf, run inetd -c to update the daemon, then transfer a file and look at syslog.log. Now add the -i -o options and look at xferlog where you'll see the actual filename and filesize (among other pieces of info).

[Gary L. Paveza, Jr.]

Bill,

My inetd.conf has the following

ftpd -v -l -L

And I see gets (RETR) and puts (STOR) in my /var/adm/syslog/syslog.log file.

Now that I look at this, it appears that it's due to the -L (logs all commands).

[Bill Hassell]

Oops, you're correct. I have been using -l (lowercase) for years and missed the -L that was added with Wu-ftpd to log the filenames in syslog. If you need the file size and additional details, the -i -o options will still provide these details.

[Dave La Mar]

Achilles -
We commonly script our ftp jobs and capture the output to a file. i.e.
#! /bin/ksh
ftp -n -v << endl >> /home/someone/work/ftp.log
open some_server
user username userpassword
get some_file.txt (or put)
quit
endl

As you can see, this is a simplified ftp job that will log all action to ftp.log in somone's home directory. Instead of harcoding in the user name and password, one should use a .netrc file.
Search on .netrc and you will find the explanation of how this will eliminate the need for username and password.

Regards,

dl