Subject: interpretation of the log file

From: Ye He <[email-masked]>
Date: Sun, 29 Jan 1995 20:50:46 -0500 (EST)

Howdy,
I just set up wu-ftpd2.4 on a hp server. In ftpacess I enabled
both commands and transfers logs for both anonymous and real users,
and here is the ftp.log file I obtained after two test logins.

____________________________________________________________
Sun Jan 29 20:23:16 1995 1 fubini.swarthmore.edu 1017 
/pub/mitDigitool/README.SWAT b _ o a [none_given] ftp 0 *
Sun Jan 29 20:40:27 1995 1 fubini.swarthmore.edu 335 /README b _ o a 
[none_given] ftp 0 *
__________________________________________________________________

Could anybody explain to me what each field means? I typed ls, cd, 
but they didn't seem to be logged.  It seems that only transfers are
logged. Also, what does that [none-given] mean?  No email address
given? What about b _ o?  Thanks a bunch for your help in advance.

--
Ye He
[email-masked]

---

From: Ric Anderson <[email-masked]>
Date: Sun, 29 Jan 1995 19:50:42 -0700 (MST)

> Date: Sun, 29 Jan 1995 20:50:46 -0500 (EST)
> From: Ye He <[email-masked]>
> Subject: interpretation of the log file
> To: [email-masked]
> 
> Howdy,
first: please fix your .signature file to include your CORRECT email
address.  It would make replying to you much easier.

There is a man page with wu-ftpd, xferlog.5 that describes
the format of the transfer log in detail.  

If you don't add
	passwd-check rfc822 enforce
to ftpaccess, then the user can just type a "return" to the password
prompt to login anonymously.  With the above line, the user must
type a plausable looking email address.  Nothing prevents the user
from lying about the email address though.

Command logging is normally done via syslog().  Check your build
to see what value of FACILITY was used (nominally LOG_DAEMON, I
think, although I have used LOG_LOCAL7 in the past).  You have
to start ftpd with "-l" on the command line, as I recall, and also
have an appropriate entry in syslog.conf to direct the logging
for the specified facility to a file.

WARNING:  Do NOT try to put the command log in the same file as
the transfer logs.  I would expect the messages from wu-ftpd and
syslog to partially overwrite each other.

Cheers,
Ric (<[email-masked]> "Ric Anderson", using RTD's public internet access)