Configuring Logging for FTP

You can log both the FTP session information and the file transfer information, as explained in the following sections.

Enabling File Transfer Logging

You can enable file transfer logging either by editing the /etc/ftpd/ftpaccess file or by editing the /etc/inetd.conf file. These methods are explained in the following sections.

Configuring Logging in the /etc/ftpd/ftpaccess File

You can log the incoming and outgoing FTP file transfer information by using the log transfers keyword in the /etc/ftpd/ftpaccess file. The log transfers keyword enables or disables logging of file transfers for real or anonymous FTP users to the /var/adm/syslog/xferlog file. You can separately enable logging of transfers to the server (incoming) and logging of transfers from the server (outgoing).

For details on the log transfers keyword, type man 4 ftpaccess at the HP-UX prompt.

Configuring Logging in the /etc/inetd.conf File

To log incoming and outgoing FTP file transfers, insert the-i and -o options with the ftp entry in the /etc/inetd.conf file. The -iand -o options are explained as follows:

-i: This option logs all the incoming files received by the ftp server to the/var/adm/syslog/xferlog log file. The log transfers entry in the /etc/ftpd/ftpaccess file overrides the -i option.
-o: This option logs all outgoing files transmitted by ftpd to the /var/adm/syslog/xferlog file. The log transfers entry in the /etc/ftpd/ftpaccess file overrides the -o option.

Example of Logging Configuration in the /etc/inetd.conf File

In the following example, the /etc/inetd.conf entry logs both incoming and outgoing FTP file transfers:

ftp  stream tcp nowait root /usr/lbin/ftpd 
ftpd -a -l -d -i -o

Logging FTP Sessions

You can log the FTP session information to the /var/adm/syslog file. You can specify FTP session logging by using the log commands keyword in the /etc/ftpd/ftpaccess file. The log commands keyword enables or disables logging of an FTP session to the /var/adm/syslog file, including commands such as logins, login failures, and anonymous ftp activity. A log commands entry in the /etc/ftpd/ftpaccess file overrides the -L option specified for the ftp entry in the /etc/inetd.conf file.

For more information on the log commands keyword, type man 4 ftpaccess at the HP-UX prompt.

Logging FTP File Transfers

You can log FTP server daemon file transfer information to the /var/adm/syslog/xferlog log file. The xferlog file records such file transfer information as current time, file transfer time, remote host, file name, file size, and whether the file transfer is in ascii or binary format. You can also redirect the logging messages for incoming and outgoing transfers to either the /var/adm/syslog/xferlog or the /var/adm/syslog/syslog file, or both, using the following options:

log syslog

log syslog+xferlog

For more information on all the types of information recorded in the xferlog file, type man 5 xferlog at the HP-UX prompt.




	NOTE: By default (if you do not specify the `log` entry in the `/etc/ftpd/ftpaccess` file), the transfer log messages are placed in the `/var/adm/syslog/xferlog` file.

Features Related to Data Transfer

The following lists the data transfer features:

For statistical purposes, you can keep track of the total bytes of data transferred. Also, you can limit the number of data bytes a user in any given class can transfer. You can specify a directive in the /etc/ftpd/ftpaccess file to limit the number of bytes incoming, outgoing, or both.
The syntax for the directive is as follows:
data-limit [raw] in│out│total count [class]
A default limit is specified to all the classes for which you have not specified a limit. When the FTP session logs off, this directive prints the number of files and the number of bytes transferred.
You can limit the number of data files a user in the given class can transfer in a session. You can specify a directive in the /etc/ftpd/ftpaccess file to limit the number of incoming files, outgoing files, or both.
The syntax for the directive is as follows:
file-limit [raw] in│out│total count [class]
If you do not specify a class, a default limit is specified to all the classes for which a limit is not specified.

For more information, type man 4 ftpaccess at the HP-UX prompt.