Which facility dose ftpd use?

[Kiyoshi Miyake]

Hi,

Which facility dose ftpd use?

My syslog.conf is following...

*.info;mail.none /var/adm/syslog/syslog.log
kern.info /var/adm/syslog/syslog.kern
daemon.info /var/adm/syslog/syslog.daemon
user.info /var/adm/syslog/syslog.user
uucp....
....

I found message from ftpd in syslog.log.
but, I can't find message in any syslog.{facility}.
why???


And I want the list which facilities&priority OS program uses.

thanks.

[Ermin Borovac · Accepted solution]

ftpd uses local5 facility. It is matched by first line (*.info).

If you restart syslogd with -v option encoded priority and facility will be logged with the syslog message. For list of codes see syslog(3C).

[Kiyoshi Miyake]

Hi,

Thanks Ermin Borovac.

I'll try it.


Is there list like that...

ftpd -> local5
su -> auth
sendmail -> mail
...

thanks

[Ermin Borovac]

The following facility list is from syslog(3C). When using it in syslog.conf it would translate as LOG_KERN becomes kern, LOG_USER becomes user etc.

LOG_KERN
Messages generated by the kernel. These cannot be generated by any user processes.

LOG_USER
Messages generated by random user processes. This is the default facility identifier if none is specified.

LOG_MAIL
The mail system.

LOG_DAEMON
System daemons, such as inetd(1M), ftpd(1M), etc.

LOG_AUTH
The authorization system: login(1), su(1), getty(1M), etc.

LOG_SYSLOG
Messages generated internally by syslogd daemon.

LOG_LPR
The line printer spooling system: lp(1), lpsched(1M), etc.

LOG_NEWS
Messages generated by the news system.

LOG_UUCP
Messages generated by the UUCP system.

LOG_CRON
Messages generated by the CRON daemon.

LOG_LOCAL0
Reserved for local use. Similarly for LOG_LOCAL1 through LOG_LOCAL7

Someone else might know of more comprehensive list.

Also as I mentioned in the previous post, you can run syslogd with -v option and use the following list to find out what facility/level a program is using.

LOG_KERN A LOG_EMERG 0
LOG_USER B LOG_ALERT 1
LOG_MAIL C LOG_CRIT 2
LOG_DAEMON D LOG_ERR 3
LOG_AUTH E LOG_WARNING 4
LOG_SYSLOG F LOG_NOTICE 5
LOG_LPR G LOG_INFO 6
LOG_NEWS H LOG_DEBUG 7
LOG_UUCP I
LOG_CRON J
LOCAL0-7 Q-X

[Kiyoshi Miyake]

Thank you, Ermin Borovac.

According to this man page, ftpd uses "daemon".
But it uses local5...
Why?

If I can see source code, I want to do
"grep openlog *.c".

thaks.

[Bill Hassell]

HP-UX uses the Washington University ftpd (WU_FTPD) so you could download the source, but there is no way to change the local5 logging facility. You can see every faility and priority value in syslog by starting syslogd with the -v option and then running it through the attached script. It will format syslog something like this:

Apr 5 01:18:44 LOCAL5:INFO ftpd[10090]: FTP session closed
Apr 5 01:19:00 LOCAL5:INFO ftpd[10091]: ANONYMOUS FTP LOGIN FROM ghost [192.168.
2.5], ftp
Apr 5 01:19:00 LOCAL5:INFO ftpd[10091]: FTP session closed
Apr 5 21:59:06 DAEMON:INFO xntpd[20240]: synchronized to 67.128.71.75, stratum=2

Apr 5 21:59:41 DAEMON:INFO xntpd[20240]: synchronized to 18.26.4.105, stratum=1

[Kiyoshi Miyake]

Thank you Bill Hassell.

I see why ftpd use local5.
Thank for script. I try it.

[David de Beer]

Greetings Kiyoshi Miyake,

Yes, ftpd uses local5 - unless you use tcpwrappers. Then it's all fluffy.

With TCP Wrappers, for some strange reason - ftpd gets logged under mail.info:

mail.info /var/adm/syslog/ftpd.log

works on our machines where tcp-wrappers are used.

David de Beer.