Proftpd not create logs

weed · Jul 26, 2014

My Proftpd not create diary, I did not find the relevant information GOOGL, I do not know how to solve, very upset

System Configuration: DirectAdmin 1.45.4 / CentOS 5.10 64-bit / CustomBuild 1.2

Proftpd Configuration: /etc/proftpd.conf

Code:

ServerName		"ProFTPd"
ServerType          	standalone

Port			21
PassivePorts		35000 35999
UseReverseDNS		off
TimesGMT		off
TimeoutLogin		120
TimeoutIdle		600
TimeoutNoTransfer	900
TimeoutStalled		3600

ScoreboardFile			/var/run/proftpd/proftpd.pid

TransferLog		/var/log/proftpd/xferlog.legacy
LogFormat		default "%h %l %u %t \"%r\" %s %b"
LogFormat		auth    "%v [%P] %h %t \"%r\" %s"
LogFormat		write   "%h %l %u %t \"%r\" %s %b"

#DON'T modify this log format.  It's used by DirectAdmin to determine user usage
LogFormat		userlog "%u %b %m %a"
ExtendedLog		/var/log/proftpd/103.249.109.201.bytes WRITE,READ userlog

AuthUserFile                    /etc/proftpd.passwd
DefaultServer		on
AuthOrder mod_auth_file.c

#AuthPAM off

<IfModule mod_tls.c>
	TLSEngine on
	TLSLog /var/log/proftpd/proftpd.tls.log
	TLSProtocol SSLv23
	#TLSProtocol TLSv1
	TLSVerifyClient off
	TLSRequired off
	
	#Certificates
	TLSRSACertificateFile /etc/exim.cert
	TLSRSACertificateKeyFile /etc/exim.key
	#TLSCACertificateFile /etc/ftpd/root.cert.pem

	TLSCipherSuite HIGH:MEDIUM:+TLSv1:!SSLv2:+SSLv3
</IfModule>

<Global>
	PassivePorts            35000 35999
	DeferWelcome		on

	RequireValidShell	no

	DefaultRoot		~
	DirFakeUser on ftp
	DirFakeGroup on ftp

	User			ftp
	Group			ftp
	#UserAlias		anonymous ftp

	AllowStoreRestart	on
	AllowRetrieveRestart	on

	ListOptions		-a
	ShowSymlinks		on
	<IfModule mod_facts.c>
		##Enable this with proftpd 1.3.4b+ to fix FileZilla MLSD
		##http://www.proftpd.org/docs/modules/mod_facts.html#FactsOptions
		# FactsOptions UseSlink
	</IfModule>

	Umask			022
	DisplayLogin		welcome.msg
	DisplayChdir		readme
	AllowOverwrite		yes
	IdentLookups		off
	ExtendedLog		/var/log/proftpd/access.log WRITE,READ write
	ExtendedLog		/var/log/proftpd/auth.log AUTH auth
	
	#
	# Paranoia logging level....
	#
	#ExtendedLog    /var/log/proftpd/paranoid.log ALL default

	<IfModule mod_tls.c>
		TLSEngine on
		TLSLog /var/log/proftpd/proftpd.tls.log
		TLSRSACertificateFile /etc/exim.cert
		TLSRSACertificateKeyFile /etc/exim.key
	</IfModule>
</Global>

Include /etc/proftpd.vhosts.conf

/var/log/proftpd directory, All Diary never updated

smtalk · Jul 26, 2014

Do you mean logs like /var/log/proftpd/access.log? Please post the output of:

Code:

ps auxw | grep ftpd

weed · Jul 26, 2014

smtalk said:
Do you mean logs like /var/log/proftpd/access.log? Please post the output of:

Code:

ps auxw | grep ftpd

Yes! I'm sorry, my English is not good, I was translated by Google.

"ps auxw | grep ftpd" Display

Code:

[root@hk ~]# ps auxw | grep ftpd
root      6782  0.0  0.0  93400  1644 ?        Ss   Jul20   0:40 pure-ftpd (SERVER)                                                                                                                                                                                                                                                                                                                                             
sichuanc 14974  0.0  0.0  95608  1320 ?        S    17:51   0:00 pure-ftpd (IDLE)                                                                                                                                                                                                                                                                                                                                               
root     14975  0.0  0.0  95496  1024 ?        S    17:51   0:00 pure-ftpd (PRIV)                                                                                                                                                                                                                                                                                                                                               
hktest   16656  0.0  0.0  95608  1320 ?        S    18:09   0:00 pure-ftpd (IDLE)                                                                                                                                                                                                                                                                                                                                               
root     16657  0.0  0.0  95496  1024 ?        S    18:09   0:00 pure-ftpd (PRIV)                                                                                                                                                                                                                                                                                                                                               
root     24923  0.0  0.0  93404   872 ?        S    18:14   0:00 pure-ftpd (IDLE)                                                                                                                                                                                                                                                                                                                                               
root     24924  0.0  0.0  95496  1024 ?        S    18:14   0:00 pure-ftpd (PRIV)                                                                                                                                                                                                                                                                                                                                               
root     24967  0.0  0.0  93404   872 ?        S    18:14   0:00 pure-ftpd (IDLE)                                                                                                                                                                                                                                                                                                                                               
root     24968  0.0  0.0  95496  1024 ?        S    18:14   0:00 pure-ftpd (PRIV)                                                                                                                                                                                                                                                                                                                                               
root     25018  0.0  0.0  61352   800 pts/0    S+   18:14   0:00 grep ftpd
root     30381  0.0  0.0  93404   876 ?        S    18:00   0:00 pure-ftpd (IDLE)                                                                                                                                                                                                                                                                                                                                               
root     30382  0.0  0.0  95496  1024 ?        S    18:00   0:00 pure-ftpd (PRIV)

smtalk · Jul 26, 2014

It means you are not running proftpd at all

Please check /var/log/messages for FTP activity:

Code:

grep 'pure-ftpd' /var/log/messages

weed · Jul 26, 2014

smtalk said:
It means you are not running proftpd at all Please check /var/log/messages for FTP activity:

Code:

grep 'pure-ftpd' /var/log/messages

"grep 'pure-ftpd' /var/log/messages" Shows the diary, I have listed a small part

Code:

Jul 26 18:46:38 hk pure-ftpd: ([email protected]) [INFO] New connection from 106.120.174.119
Jul 26 18:46:40 hk pure-ftpd: ([email protected]) [WARNING] Authentication failed for user [[email protected]]
Jul 26 18:46:40 hk pure-ftpd: ([email protected]) [INFO] Logout.
Jul 26 18:46:40 hk pure-ftpd: ([email protected]) [INFO] New connection from 211.149.211.125
Jul 26 18:46:44 hk pure-ftpd: ([email protected]) [WARNING] Authentication failed for user [bdpan888]
Jul 26 18:46:44 hk pure-ftpd: ([email protected]) [INFO] Logout.
Jul 26 18:46:44 hk pure-ftpd: ([email protected]) [INFO] New connection from 106.120.174.119
Jul 26 18:46:46 hk pure-ftpd: ([email protected]) [WARNING] Authentication failed for user [ashui123]
Jul 26 18:46:46 hk pure-ftpd: ([email protected]) [INFO] Logout.
Jul 26 18:46:49 hk pure-ftpd: ([email protected]) [INFO] New connection from 211.149.211.125
Jul 26 18:46:49 hk pure-ftpd: ([email protected]) [WARNING] Authentication failed for user [bdpan666]
Jul 26 18:46:49 hk pure-ftpd: ([email protected]) [INFO] Logout.
Jul 26 18:46:50 hk pure-ftpd: ([email protected]) [INFO] New connection from 106.120.174.119
Jul 26 18:46:53 hk pure-ftpd: ([email protected]) [WARNING] Authentication failed for user [ashui888]
Jul 26 18:46:53 hk pure-ftpd: ([email protected]) [INFO] Logout.
Jul 26 18:46:53 hk pure-ftpd: ([email protected]) [INFO] New connection from 211.149.211.125

/var/log/proftpd/access.log No Log

SeLLeRoNe · Jul 26, 2014

Well cause access.log is proftpd related log, you're using pure-ftpd, so it should (in case), have its own log and its own directory, but probalbly it just use messages logs instead have owned file as proftpd.

Regards

weed · Jul 26, 2014

Sorry, but thank you very much! I was too negligent

Proftpd not create logs

weed

Verified User

smtalk

Administrator

weed

Verified User

smtalk

Administrator

weed

Verified User

SeLLeRoNe

Super Moderator

weed

Verified User