Subject: logging of transfers and commands to the xferlog file

From: "Mark M. Gray" <[email-masked]>
Date: Tue, 15 Oct 1996 09:04:09 -0500 (CDT)

ALL,

I recently installed wu-ftpd on a solaris 2.5 system.  I can't get any 
file transfers or commands logged to my xferlog file.  All files exist and
should have the correct permissions.  Below are my inetd.conf
entries for ftpd and the header information from pathnames.h.

pathnames.h:

 * @(#)pathnames.h 5.2 (Berkeley) 6/1/90 */

#define _PATH_FTPUSERS  "/etc/ftpusers"
#define _PATH_FTPACCESS "/usr/local/etc/ftpaccess"
#define _PATH_EXECPATH  "/bin/ftp-exec"
#define _PATH_PIDNAMES  "/usr/local/daemon/ftpd/ftp.pids-%s"
#define _PATH_CVT       "/usr/local/etc/ftpconversions"
#define _PATH_XFERLOG   "/var/adm/xferlog"
#define _PATH_PRIVATE   "/etc/ftpgroups"
 
#ifndef _PATH_UTMP
#define _PATH_UTMP      "/var/adm/utmp"
#define _PATH_WTMP      "/var/adm/wtmp"
#define _PATH_LASTLOG   "/var/adm/lastlog"
#endif
 
#define _PATH_BSHELL    "/bin/sh"
#define _PATH_DEVNULL   "/dev/null"
 
#ifdef  HOST_ACCESS
#define _PATH_FTPHOSTS  "/usr/local/etc/ftphosts"
#endif

================================================================================

inetd.conf:

ftp     stream  tcp     nowait  root    /usr/sbin/tcpd  /usr/local/etc/ftpd -a

any help is greatly appreciated.

Mark Gray

---

From: [email-masked] (Koos van den Hout _U nix and we all_)
Date: Tue, 15 Oct 1996 20:26:07 +0200 (MET DST)

Quoting Mark M. Gray, who wrote :

> file transfers or commands logged to my xferlog file.

Commands are logged via syslog.

Check the binary with strings to see where the xferlog path ends up.
It could be changed due to some #ifdef.

                                               Grtx KH

-- 
  Koos van den Hout,     Internetter, Unix freak, ISFJ and BBS SysOp at large
  [email-masked] (Home)        BBS Koos z'n Doos (+31-30-6036637 28k8)
  [email-masked] (Work)  <-- finger -l for PGPkey    (+31-30-6056619 14k4)
  http://www.hvu.nl/~koos (WWW)    Looking for a license plate with "RFC 822"
  Unix op z'n NL's : Segment overtreding - kern uitgescheten       KH106-RIPE

---

From: Alain Magloire <[email-masked]>
Date: Tue, 15 Oct 1996 17:00:58 -0400 (EDT)

> entries for ftpd and the header information from pathnames.h.

I did really check but .. you have to enable logging with ftpaccess file

log command <type>

  will send stuff to syslog

log transfert <type>

  will send stuff to _PATH_XFERLOG .. xferlog

sorry don't know the exact syntax

man ftpaccess
should reveal them to you

Note: I don't use Solaris, but they was some report
      that wu-ftpd screw up wtmpx. Don't know if it was fix
      in the beta-??.
      There is/was a patch ... some where :)

--
au revoir, alain

---

From: Bob Dougherty <[email-masked]>
Date: Thu, 17 Oct 1996 00:38:37 -0400

Has anyone tried analyzing ftpd log files to identify which file transfers
are failing?  The xferlog file is not useful for this:  if a user's
connection terminates in mid-transfer, a record is never written to
xferlog. 

I've patched the ftpd.c file so that xferlog-type records are sent to
syslog along with the ftp commands (if command logging is enabled).  More
recently, I've added a patch to send a similar record at the very
beginning of the file transfer.  Now I can post-process the syslog to
identify failed file transfers.  The trick is to find records for
initiated file transfers that don't have corresponding end-of-transfer
records. 

I no longer even use the xferlog file.  The syslog file with xfer
records provides much more complete information.

I'm starting to wonder whether others are doing similarly detailed
analyses that aren't possible with the xferlog file.  I'm also wondering
if there are any risks associated with this approach.

-- 
Bob Dougherty                            Internet: [email-masked]
Institute for Scientific Information     Voice: (215) 386-0100, ext. 1161
3501 Market St., Philadelphia PA 19104   Fax:   (215) 386-6362