inetdand ftpd logs pollute my syslog

[marc seguin]

Hello,

I have ftp connections every five minutes on a server and 2 messages are added in syslog.log every time :
Oct 15 12:23:45 hawking telnetd[7136]: getpid : peer died: Error 0
Oct 15 12:23:45 hawking ftpd[7137]: connection from admin2 at Tue Oct 15 12:23:45 2002

How can I redirect to another file these messages which pollute my syslog.log, in order to keep interesting messages ?

Thanks

[Stefan Farrelly]

You can stop the ftp messages going to syslog one of 2 ways;

1. Remove the -L option form /etc/inetd.conf on the ftpd line.
2. In /etc/syslog.conf change;
*.info;mail.none /var/adm/syslog/syslog.log
To
*.info;mail.none;ftpd.none /var/adm/syslog/syslog.log

Then restart syslog.

But I dont think you can redirect ftp log messages to somewhere else apart from syslog. According to the manpage for ftpd they can only be logged to syslog and ive tried modifying the /etc/syslog.conf file to redirect ftp messages to a different log but it doesnt work - fptd must be writing direct to syslog.log itself (not via syslog daemon) so youre out of luck on redirecting im afraid.

[Paula J Frazer-Campbell]

Hi

This entry:-

Oct 15 12:23:45 hawking telnetd[7136]: getpid : peer died: Error 0

is not from an ftp but from a telnet connection being dropped as oposed to closed.

Paula

[Paula J Frazer-Campbell]

Soorty I have reread your question.

As has been said a redirect is not possible but !!!

Cron a job to do :-

cat /var/adm/syslog/syslog.log | grep ftpd > /var/adm/syslog/sys_ftp.log
cat /avar/adm/syslog/syslog.log | grep -v ftpd > /var/adm/syslog/syslog.clean
cp /var/adm/syslog/syslog.log /var/adm/syslog.bak
mv /var/adm/syslog/syslog.clean /var/adm/syslog/syslog.log

Or you could keep this as a script and run it as and when.


HTH
Paula

[Paula J Frazer-Campbell]

With out the Typos


Sorry I have reread your question.

As has been said a redirect is not possible but !!!

Cron a job to do :-

cat /var/adm/syslog/syslog.log | grep ftpd > /var/adm/syslog/sys_ftp.log

cat /var/adm/syslog/syslog.log | grep -v ftpd > /var/adm/syslog/syslog.clean
cp /var/adm/syslog/syslog.log /var/adm/syslog.bak

mv /var/adm/syslog/syslog.clean /var/adm/syslog/syslog.log

Or you could keep this as a script and run it as and when.


HTH
Paula

[Paula J Frazer-Campbell]

Marc

Also see:-


http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x4765c1c4ceddd61190050090279cd0f9,00.html

And pay attention to Darrell's post.

Paula

[marc seguin]

Yes, it looks as is not possible.

The entry ftpd.* is not accepted in syslog.conf (I checked it with syslogd -d)

ftp logs are logs among all daemon logs.
And it's a "All or nothing" choice !

So I just wrote a script to clean logs when needed :

if [[ -n "$1" && -r "$1" ]]; then
SYSLOG=$1
else
SYSLOG=/var/adm/syslog/syslog.log
fi

cat $SYSLOG | grep -v -e "hawking telnetd\[[0-9]*\]: getpid : peer died: Error 0$" -e "hawking ftpd\[[0-9]*\]: connection from admin2 at"

Thanks for your help understanding the syslog.conf file.

[Jordan Bean]

ftpd logs to LOCAL5. Redirect that to another file.

inetd logs to DAEMON. I'm not sure to where telnetd sends its logs.

[marc seguin]

local5 redirection doesn't include ftpd messages on my system (HP-UX 10.20).
Perhaps it is valid for HP-UX 11...