Professional File Transfer with proFTPD - Timberrrrrrrrr! (Page 8 of 11 )
By default, proFTPD logs all messages to the system logger, usually "/var/log/messages". You can alter the level of logging via the SystemLog directive,
# set system logging level
SyslogLevel debug
or even tell proFTPD to log all file transfers by means of the TransferLog
directive.
# set transfer log
TransferLog /var/log/xferlog
With this configuration, proFTPD logs all transfers to "/var/log/xferlog".
This data may then be read by an automated tool to calculate transfer statistics and bandwidth usage.
Here's a snippet of the system log,
May 7 17:03:58 olympus proftpd[7616]: olympus.melonfire.com
(localhost.localdomain[127.0.0.1]) - FTP session closed.
May 7 17:06:03 olympus proftpd[11531]: olympus.melonfire.com
(localhost.localdomain[127.0.0.1]) - FTP session opened.
May 7 17:06:10 olympus proftpd[11531]: olympus.melonfire.com
(localhost.localdomain[127.0.0.1]) - FTP session closed.
May 7 17:06:22 olympus proftpd[4096]: olympus.melonfire.com - received SIGHUP --
master server rehashing configuration file
May 7 17:06:24 olympus proftpd[11933]: olympus.melonfire.com
(localhost.localdomain[127.0.0.1]) - FTP session opened.
and here's
a snippet of the transfer log.
Wed May 7 11:20:00 2003 0 olympus.melonfire.com 9144 /home/joe/mbox b
_ o r joe ftp 1 * c
Wed May 7 11:20:19 2003 0 olympus.melonfire.com 0
/home/joe/outfile b _ i r joe ftp 1 * c
Wed May 7 12:42:11 2003 2 olympus.melonfire.com 8820072
/home/ftp/pub/winapps/acroread/ar500enu.exe b
_ o a a@a.com ftp 1 * c
Wed May 7 14:11:32 2003 0 olympus.melonfire.com 9144
/home/ftp/incoming/mbox b _ i a a ftp 1 * c
You can perform
so-called extended logging, in which all commands sent to the server are recorded to a file, with the ExtendedLog directive. This directive also allows you to specify the type of commands that are tracked - for example, use the keyword AUTH for authentication commands, RETR for file retrieval commands, or ALL for all commands (a complete list of supported keywords is available in the proFTPD documentation).
# set extended log
ExtendedLog /var/log/proftpdlog ALL
Here's a snippet of this log:
olympus.melonfire.com UNKNOWN ftp [07/May/2003:17:03:34 +0530] "SYST"
215 -olympus.melonfire.com UNKNOWN ftp [07/May/2003:17:03:39 +0530] "PASV" 227 -olympus.melonfire.com UNKNOWN ftp [07/May/2003:17:03:39 +0530] "LIST" 226123olympus.melonfire.com UNKNOWN ftp [07/May/2003:17:03:42 +0530] "CWD pub" 250 -olympus.melonfire.com UNKNOWN ftp [07/May/2003:17:03:49 +0530] "QUIT" 221 -olympus.melonfire.com UNKNOWN nobody [07/May/2003:17:03:54 +0530] "USER upload" 331 -olympus.melonfire.com UNKNOWN upload [07/May/2003:17:03:56 +0530] "PASS (hidden)" 230 -olympus.melonfire.com UNKNOWN upload [07/May/2003:17:03:56 +0530] "SYST" 215 -olympus.melonfire.com UNKNOWN upload [07/May/2003:17:03:58 +0530] "QUIT" 221 -olympus.melonfire.com UNKNOWN nobody [07/May/2003:17:06:26 +0530] "USERftp" 331 -olympus.melonfire.com UNKNOWN ftp [07/May/2003:17:06:26 +0530]"PASS a" 230 -olympus.melonfire.com UNKNOWN ftp [07/May/2003:17:06:26+0530] "SYST" 215 -olympus.melonfire.com UNKNOWN ftp[07/May/2003:17:06:31+0530] "QUIT" 221 -
You can also set the server's debugging level with the DebugLevel directive, which must be followed by a number between 0 and 9 - this can come in handy if you experience problems with server startup or operation.
DebugLevel 9
Another way to obtain debugging output is to start the server with the
"-d" parameter, followed by a number between 0 and 9. Consider the following example, which demonstrates:
$ /usr/local/ftpd/sbin/proftpd -nd3
- parsing '/usr/local/ftpd/etc/proftpd.conf' configuration
- <Directory *>: adding section for resolved path '*'
- <Directory incoming>: adding section for resolved path '/incoming'
olympus.melonfire.com - ProFTPD 1.2.8 (stable)
(built Wed May 7 10:22:32 IST 2003) standalone mode STARTUP
olympus.melonfire.com (olympus.melonfire.com[127.0.0.1]) -
mod_cap/1.0: capabilities '= cap_chown,cap_net_bind_service+ep'.
olympus.melonfire.com (olympus.melonfire.com[127.0.0.1]) -
dispatching POST_CMD command 'PASS (hidden)' to mod_log
olympus.melonfire.com (olympus.melonfire.com[127.0.0.1]) -
dispatching POST_CMD command 'PASS (hidden)' to mod_ls
olympus.melonfire.com (olympus.melonfire.com[127.0.0.1]) -
dispatching POST_CMD command 'PASS (hidden)' to mod_auth
olympus.melonfire.com (olympus.melonfire.com[127.0.0.1]) -
dispatching LOG_CMD command 'PASS (hidden)' to mod_log
olympus.melonfire.com(olympus.melonfire.com[127.0.0.1]) -
dispatching PRE_CMD command 'SYST' to mod_core
olympus.melonfire.com (olympus.melonfire.com[127.0.0.1]) -
dispatching PRE_CMD command 'SYST' to mod_core
olympus.melonfire.com (olympus.melonfire.com[127.0.0.1]) -
dispatching CMD command 'SYST' to mod_core
olympus.melonfire.com (olympus.melonfire.com[127.0.0.1]) -
dispatching LOG_CMD command 'SYST' to mod_log .
Next: Getting Virtual >>
More Administration Articles
More By Vikram Vaswani, (c) Melonfire
