ftp sessions log

[shashang]

hello guys,
I am using unix tru64 4.0f. Is there any way in which I can record the ftp session connecting my server along with the user id.
Thanx in anticipation.

shashang.

[Bharat Katkar]

As far as i know there is no special file for FTP log. You have to edit syslog file for this.

This is what i will do on HPUX M/c.
(Go thr SAM, go to syslog viewer and user Filter to get the FTP related log from syslog.log file.)

See if you can do same thing on TRU64.4

Hope this helps you out.

[G. Vrijhoeven]

Hi,

This is the HPUX forum and not the Tru64 forum. So if i am not correct, i have an excuse....

the ftpd is spawned by the inetd, to alter the logging of that deamon you will have to edit the /etc/inetd.conf. There should be a line that has ftpd in it. Alter that line so the ftpd is started in debugging mode. ftpd -dl
In addition to that you can alter the /etc/syslog.conf so all ftp warnings are logged. ( check man pages for exact syntax please)

HTH,

Gideon

[Michael Schulte zur Sur · Accepted solution]

Hi,

you may want to add -dl to the ftpd entry in /etc/inetd.conf. Then do a kill -HUP on the inetd and you should have a log of ftp activity including user and commands in /var/adm/syslog.dated/current/daemon.log or user.log.

hth,

Michael

[Joseph Loo]

hi,

at /etc/inetd.conf, look for the ftp line. at the end of the line, default is "ftpd -l". replace it with "ftp -oil" and do this to re-start inetd:

# inetd -c

this will generate a log file, xferlog under the directory, /var/adm/syslog/

however, take note that -o option is overriden by the /etc/ftpd/ftpaccess file.

regards.

[Edwin Dikhooff]

Hi,

In HPUX, using the option -l -a at the ftpd line within the inetd.conf you force ftpd to use the ftpaccess file in /etc/ftpd.
In this file you can specify what to log with the line:
log transfers real inboud,outbound

All loggings are placed in /var/adm/syslog/xferlog

The ftpaccess file can also enable access lists for ftpsessions from networks/hosts, block specific files for ftp.
For more details check the man pages for the correct syntax.

Hopes this helps you on your way.

Edwin

[Mobeen_1]

Shashang,
There are various means to accomplish what you are looking for. Perhaphs the 2 discussion threads below give you all the information that you are looking for

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=187078

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=96479

regards
Mobeen

[shashang]

thanx michael schulte, giving kill -HUP solved my problem. Can u explain what does kill -1 (HUP) does. As only putting the -l flag in the inetd.conf file did not work.

[shashang]

thanx michael schulte, giving kill -HUP solved my problem. Can u explain what does kill -1 (HUP) does. As only putting the -l flag in the inetd.conf file did not work. Also is there any way in which i can create a seperate file to log these ftp entries.

[Joseph Loo]

hi,

have you try, adding "ftp -oil" to the end of the line for ftpd in the inetd.conf file?

as for what HUP means:
# kill -HUP
is equivalent to doing
# inetd -c
to restart the process.

regards.

[Michael Schulte zur Sur]

Hi,

editing the inetd.conf doesn't do you any good because the inetd is not aware of any change. kill -HUP forces it to reread the conf file.

greetings,

Michael

[Michael Schulte zur Sur]

Well,

overlooked the question in the second post of you. Could you please explain, what you want exactly?

thanks,

Michael

[shashang]

Michael, the ftp session entries are created in /var/adm/syslog.dated/current/daemon.log file along with other entries. Is there any way in which I can change the path only for the ftp entries i.e logging the ftp entries in a diff. file?

Regards,
shashang.