For anyone reading this thread searching for a way to find out how to get transfers and logins from PureFTPD split into two different files: please ignore most of what is mentioned in this, and linked threads. It will save you a lot of time, because there's a lot of misinformation here.
The topic starter shows an init script with two -O options in it (well, in fact he accidentally left out one -O, but he clears that up later). Two -O options will
not work. The reason he initially got split log files working is
not because of the two -O options.
As the PureFTPD docs mention,
all messages go to the default syslog daemon, and (by default) will log all messages to the default system log file (e.g. for CentOS: /var/log/messages). This is not what you'd generally want. The PureFTPD FAQ mentions how to easily change that:
Code:
Log messages are sent to the syslog daemon. The syslog daemon is often
called syslogd or syslog-ng. He's in charge of dispatching logging events
from various programs to log files, according to a "facility" (category) and
a "priority" (urgency: debug, info, warning, error, critical...) .
Pure-FTPd logging messages are send with the "ftp" facility by default (or
"local2" on some older systems without the "ftp" facility) . Unless you told
the syslogd to redirect messages with the "ftp" facility to a specific file,
the messages will be merged into /var/adm/messages, /var/log/messages,
/var/adm/syslog or /var/log/syslog.
Check /etc/syslogd.conf. You should have a line like:
*.*;mail.none;news.none -/var/log/messages
just add ftp.none:
*.*;ftp.none;mail.none.news.none -/var/log/messages
And if you want FTP info go in a specific file, just add:
ftp.* /var/log/ftp
and all FTP messages will go in /var/log/ftp . And only there.
So that's step one, PureFTPD messages go into their own file now. But now you want to split out the transfers. This requires two things:
1. PureFTPD must be compiled with the --with-altlog option (/usr/local/directadmin/custombuild/configure/pureftpd/configure.pureftpd)
2. You must specify an alt log location in the PureFTPD init script
(/etc/rc.d/init.d/pure-ftpd)
John makes things more complicated
when he advises to use an option in configure.pureftpd that simply doesn't exist. Granted, he warns that he's not 100% sure about the syntax. Well, the syntax is much simpler than what John suggests: it's just
--with-altlog, with no extra's (really, there are no extra's for this option).
To filter out the transfers from all other FTP messages, PureFTPD has the
-O initialization option, (which, as I just explained, requires the binary to be compiled with --with-altlog).
The PureFTPD docs say:
Code:
- '-O <format>:<log file>': Record all file transfers into a specific log
file, in an alternative format.
The emphasis here, is on
all file transfers. The topic starter seems to have misunderstood this, he tried to log authentication messages with the -O option. That will never work.
Now, at the time I'm writing this (July 2015), most of the settings I mention were already in place in Custombuild 2.0. But they're set up a bit strange: the -O option uses /var/log/pureftpd.log, which suggests a "main" FTP log location, not a transfer log. I changed that to /var/log/pureftpd-transfer.log. And it's not working out of the box, because what was missing was the rsyslog redirection from the default syslog to a specific ftp log. Without that, the seperate transfer-logging will not work.
Pro tip: make sure you add the log file in which you log authentications to CSF&LFD to scan for failed logins.
UPDATE August 3 2015: Although things work perfectly after making the changes I've listed above, and after restarting rsyslogd, there does seem to be a problem when the logs get rotated. When running some tests: logging in and logging out over FTP, transferring some files, deleting some, I see two files appear: my transfer log and my regular log in which (mostly) the logins are kept. But after a while, the pureftpd.log goes missing and doesn't return anymore. I'm not sure why, but I assume it has to do with log rotation. Strangely enough, /etc/logrotate.d/pure-ftpd neatly lists the pureftpd.log file. It doesn't list the transferlog, so you may want to add it for rotation there too. Restarting rsyslog and forcing a logrotate through
Code:
logrotate -f /etc/logrotate.conf
...shows the rotated and newly created transfer and main pureftpd.log files. This is what I'd expect, so hopefully it's working now, but it doesn't explain why the log file went missing earlier. I do notice that in the /etc/logrotate/.d/pure-ftpd configuration file, there are commands for restarting pure-ftpd after a logrotate, but they're commented out. I'm not sure why the commands are there (although I see cPanel-related articles mentioning adding those lines), and I'm not sure why they are commented out by default. I'll report back if strange things start to occur.
Maye that's a pure-ftpd bug.