How can i redirect messages from ftpd to other logfile?

[Leif Johansson]

The problem is that we get many messages in /var/adm/syslog/syslog.log from ftpd about deletion of files. Like this one: "Mar 15 11:49:55 kramer ftpd[28492]: kemlab of kramer.orebroll.se [172.16.247.108] deleted /home/kemlab/in/K0859687"

We have already removed -l from inetd.conf but that only stops logon/logoff messages from appearing in syslog.log.

My question is how can we stop logging or redirect to other log file?

[Mark Grant]

You might want to have a look at the "log" option in /etc/ftpd/ftpaccess (man ftpaccess).

[Geoff Wild · Accepted solution]

Add this to syslog.conf:
daemon.info;mail.none /var/adm/syslog/daemon.log

Unfortunately - if you run MC/SG - then those messages will go there too...


Rgds...Geoff

[Geoff Wild]

Forgot to mention - you have to restart syslog daemon - kill -HUP

Rgds...Geoff

[Leif Johansson]

Thanks for all help!
I think Im on the right track now.
This configuration of /etc/syslog.conf makes all messages, like delete of files thru ftp, go to /var/adm/syslog/daemon.log.

# @(#)B.11.11_LR
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/daemon.log
*.warning;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *


Do you think we are going to loose any important messages with this configuration?

[Benedetto Mangiapane]

Hi,
I've a similar problem.
I must redirect ftpd log in other file that are not syslog.log.
This is possible?

Look around the man of files like ftpaccess, inetd.conf I have not found nothing.

Thanks.

[BFA6]

I've been setting the same thing up on my servers recently and for my systems I found that ftpd did not use the syslog facility of daemon.info but used local5.info so you might need to change syslog.conf to be something like the attached file. ( Which also contains a version that did not work )

Regards,
Simon

[BFA6]

Leif,

Looking at your setup the line:-

*.info;mail.none /var/adm/syslog/daemon.log

Would mean that any messages of the info level will go to daemon.log not just ftpd or other daemons. This could include authorisation messages from su etc. if they write to auth.info priority rather than say auth.alert or auth.err

Try having set up with
daemon.info;mail.none /var/adm/syslog/daemon.log
*.info;mail.none;daemon.none /var/adm/syslog/syslog.log


If ftpd is still writing messages to syslog.log then try

local5.info;mail.none /var/adm/syslog/local5.log
*.info;mail.none;local5.none /var/adm/syslog/syslog.log

You know you can test stuff user the logger command?

logger -p daemon.info "Daemon test message"
logger -p local5.info "local5 test message"

Regards,
Simon