ftp messages -filling up syslog.

[Steve Bear_1]

My syslog is filling up with the following messages.

message start------
Aug 18 09:31:29 prod1 ftpd[9528]: command: QUIT^M
Aug 18 09:31:29 prod1 ftpd[9528]: <--- 221
Aug 18 09:31:29 s ftpd[9528]: Goodbye.
Aug 18 09:31:29 prod1 ftpd[9528]: FTP session closed
Aug 18 09:31:29 prod1 ftpd[9528]: FTP session closed
Aug 18 09:31:30 prod1 ftpd[9529]: <--- 220
Aug 18 09:31:30 prod1 ftpd[9529]: prod1 FTP server (Version 1.1.214.6 Wed
Feb 9 08:03:34 GMT 2000) ready.
message end-----

These messages are written to syslog after every minute. I dont even have inetd logging enabled on my server.
# ps -ef | grep inet
root 589 1 0 May 3 ? 3:29 /usr/sbin/inetd


and also i could not find any active ftp connections.

# netstat -a | grep ftp
tcp 0 0 *.ftp *.* LISTEN

Can any one please assist me what could be the problem.

Thanks.

[Massimo Bianchi]

Hi,
check logging in the file

/etc/inetd.conf

The entry should look like
ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l


after the change, let inetd re-read the config file

inetd -c

Massimo

[Steve Bear_1]

I have got the correct entry is /etc/inetd.conf
as u mentioned.

ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l -v

The problem i've posted earlier has just been started a day ago.

Thanks.

[Michael Tully]

You no doubt have verbose logging turned on in your /etc/inetd.conf file.

your line will look like this:

ftp stream tcp nowait root /usr/lbin/ftpd ftpd -lv

It should be:

ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l

After making the changes:
# /usr/sbin/intetd -c

which will force the inetd daemon to re-read the config file.

[Massimo Bianchi]

You have also the "-v", which means verbose.

-v The debugging information is written to the syslog
file.



Tear it off, and problem should go away after restarting inetd.

Massimo

[Robert-Jan Goossens]

Hi,

Check next patch,

http://www4.itrc.hp.com/service/patch/patchDetail.do?patchid=PHNE_23949&context=hpux:800:11:00

1. wu-ftpd guest logins cause unnecessary syslog messages.

your version of ftpd 1.1.214.6, latest is 1.1.214.7.

Hope it helps,

Robert-Jan.

[yogesh_4]

Hi,
Remove -v option at the end of FTP stream in /etc/inetd.conf file . then give #inetd -c to make the change to take effect and then see if loging is stopped or not.

[Steve Bear_1]

after disabling -v option in /etc/inetd.conf .

now my syslog.log is filling up with

Aug 18 10:13:29 prod ftpd[13186]: FTP session closed
Aug 18 10:13:29 prod ftpd[13186]: FTP session closed
Aug 18 10:13:33 prod ftpd[13187]: FTP session closed
Aug 18 10:13:33 prod ftpd[13187]: FTP session closed
Aug 18 10:13:34 prod ftpd[13188]: FTP session closed
Aug 18 10:13:34 prod ftpd[13188]: FTP session closed
Aug 18 10:14:33 prod ftpd[13615]: FTP session closed
Aug 18 10:14:33 prod ftpd[13615]: FTP session closed


we do have -v enabled on other servers and they seems to have no messages in syslog.log which i posted earlier.


Any help?

Thanks,

[Michael Tully]

Compare the ftp scripts being used as well as the patch version of ftp itself. I'm sure you will find some differences. To see the patched version (level), just start an 'ftp' session to another system.