syslog.log is getting too big

[Simon R Wootton]

My syslog.log grows at an alarming rate and makes important messages difficult to find. The reason is thousands of FTP messages (we use ftp alot!). I need to stop these messages (and other irrelevent messages) from hitting the syslog.

I believe there is a parameter in /etc/inetd.conf for ftp to do with logging (-l option ?) but wondered if this was the best option and what else is available to properly monitor the syslog.

All help is rewarded !

Thankyou
Simon

[harry d brown jr]

You could remove the "-l" option from your ftpd line in /etc/inetd.conf. But then you won't have any logging (security issue??).

live free or die
harry

[Steven E. Protter]

logging is a good thing.

Once a week, cron does the following things for my on syslog

cp /var/adm/syslog/syslog.log /backups/syslog.log

gzip /backups/syslog.log

> /var/adm/syslog.log

logging is your first defense against hackers, I urge you to leave it on.

SEP

[Brian Bergstrand]

Or reconfig your /etc/syslog.conf file so all FTP messages go to a different file. I'm not sure what level ftpd logs at.

[Mark Greene_1 · Accepted solution]

You could add a line to /etc/syslog.conf:

*.daemon /var/adm/syslog/daemon.log

This will write all the ftp messages to the daemon.log file. There will also be other messages from other daemon processes so you'll still have to sort through it, but it will make reading through the actual syslog.log file easier.

HTH
mark

[James R. Ferguson]

Hi SImon:

If 'ftpd' messages are a problem, drop the '-L' option from the 'etc/inetd.conf' spawn of the 'ftpd' daemon [and restart 'inetd'] or configure the 'etc/ftp/ftpaccess' file to specify a location for messages other than 'syslog'. See the man pages for 'ftpd(1M)' and 'ftpaccess(4)' for more details. Specifically note the 'log syslog+xferlog' option in 'ftpaccess'

Regards!

...JRF...

[Stefan Farrelly]

Just redirect ftp log messages to their own logfile, do it in /etc/syslog.conf

# @(#) $Revision: 74.1 $
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
local5.info;mail.none /var/adm/syslog/ftp.log
mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *

You can point the ftp.log anywhere you want, doesnt have to be in /var if youre having space issues. We back ours up weekly then cp /dev/null to them.

[Simon R Wootton]

Guys - Thankyou all - Problem will be sorted within the hour !

[Brian Bergstrand]

This mod to syslog.conf should work, but I haven't tested it. Note: This will seperate anything that logs under the daemon facility, not just FTP.

HTH.

8c8,9
< *.info;mail.none /var/adm/syslog/syslog.log
---
> *.info;mail.none;daemon.none /var/adm/syslog/syslog.log
> daemon.* /var/adm/syslog/daemon.log