Subject: why nonsuppressible syslog calls on successful actions?

From: Roger Hanke <[email-masked]>
Date: Fri, 5 Mar 1999 16:29:02 -0500

Hello All,
 While working with BeroFTPD 1.2.3 starting getting
complaints from some of the sysadm's that the
new ftpd version was flooding the Solaris system
log. But I didnt have any debugging or extra 
logging levels on.
 So checked into the code and found the messages
they were seeing in upl_check routine in extensions.c
file. The following calls are made to syslog every
time a put is performed successfully.
Was this just for development debugging
purposes and never turned off perhaps?
I ask this because when examining the latest
BeroFTPD 1.3.4 code base all of those calls
shown below are now gone.
 But even in BeroFTPD 1.3.4 and in VR16
versions I found another of syslog
calls that had been appearing with BeroFTPD 1.2.3.
In ftpd.c on line 5098 (of 1.2.3) there is if 
construct which results in LOG_NOTICE call being 
made every time a directory is created by a client.
Seems like all NOTICEs like this should be covered
by perhaps that log_security flag I see around a 
number of the other notices? Or something else 
giving you an option of suppressing essentially 
a successful mkdir message? Those were just the
messages reported to me so far, also wonder if there
are any other success messages that cant be
suppressed being output
in these VR and BeroFTPD versions? 
	Thanx,
	Roger Hanke

BeroFTPD 1.2.3
extensions.c starting line 1250
syslog(LOG_ERR,"path=%s home=%s, chroot_path=%s",path,home,chroot_path);
syslog(LOG_ERR,"realpath(path, cwdir, NULL)");
syslog(LOG_ERR,"realpath(home, abspwdir,chroot_path)");
syslog(LOG_ERR,"realpath(home, relpwdir, NULL)");
syslog(LOG_ERR,"done");

ftpd.c starting line 5098
if(anonymous) {
   syslog(LOG_NOTICE, "%s of %s [%s] created directory %s", guestpw,
remotehost, remoteaddr, path);
} else {
   syslog(LOG_NOTICE, "%s of %s [%s] created directory %s", pw->pw_name,
remotehost, remoteaddr, path);
}

-----------------------------------------------------
 Roger A. Hanke         AT&T Web Site Services
 (732)576-5738          [email-masked]
 FAX (732)576-6041      http://lynxhub.att.com/~rah/
-----------------------------------------------------

---

From: Gregory A Lundberg <[email-masked]>
Date: Fri, 5 Mar 1999 16:40:36 -0500 (EST)

On Fri, 5 Mar 1999, Roger Hanke wrote:

> While working with BeroFTPD 1.2.3 starting getting complaints from
> some of the sysadm's that the new ftpd version was flooding the
> Solaris system log. But I didnt have any debugging or extra logging
> levels on.

> So checked into the code and found the messages they were seeing in
> upl_check routine in extensions.c file. The following calls are made
> to syslog every time a put is performed successfully. Was this just
> for development debugging purposes and never turned off perhaps? I ask
> this because when examining the latest BeroFTPD 1.3.4 code base all of
> those calls shown below are now gone.

> But even in BeroFTPD 1.3.4 and in VR16 versions I found another of
> syslog calls that had been appearing with BeroFTPD 1.2.3. In ftpd.c on
> line 5098 (of 1.2.3) there is if construct which results in LOG_NOTICE
> call being made every time a directory is created by a client. Seems
> like all NOTICEs like this should be covered by perhaps that
> log_security flag I see around a number of the other notices? Or
> something else giving you an option of suppressing essentially a
> successful mkdir message? Those were just the messages reported to me
> so far, also wonder if there are any other success messages that cant
> be suppressed being output in these VR and BeroFTPD versions?

> syslog(LOG_ERR,"realpath(home, relpwdir, NULL)");

These look like debugging statements.

> remotehost, remoteaddr, path);

For messages like these (there's several more), mainly because nobody's
ever _asked_ to have them suppressed.  In fact, in the past, there were
requests for MORE such messages, which VR has added.

Personally, I think it's a good idea to know when someone's done something
special on the machine, but I can see the desire to supress them if you
really don't think such things may indicate security problems.

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: "Auteria Wally Winzer Jr." <[email-masked]>
Date: Fri, 05 Mar 1999 13:51:13 -0800

DITTO.

- WW Jr.