[Proftpd-user] proftpd ignores SystemLog

[Andreas Meyer]

Hello!

I have this in the proftpd.conf
SystemLog /var/log/proftpd/proftpd.log

but login attempts are logged to /var/log/messages.

Other logging i done like specified and works:
TransferLog /var/log/proftpd/xferlog
ExtendedLog /var/log/proftpd/auth.log AUTH auth
ExtendedLog /var/log/proftpd/access.log WRITE,READ write
ExtendedLog /var/log/proftpd/paranoid.log ALL default

Why is the SystemLog directive ignored and logging is done to
/var/log/messages? /var/log/proftpd/proftpd.log remains empty.

Greetings

Andreas

[TJ Saunders]

Post by Andreas Meyer
I have this in the proftpd.conf
SystemLog /var/log/proftpd/proftpd.log
but login attempts are logged to /var/log/messages.

Could you provide the full proftpd.conf?

Cheers,
TJ

[Andreas Meyer]

Hello!

Sorry for the late answer! This is the proftpd.conf:

ServerName "ProFTPD"
ServerType standalone
DefaultServer on

Port 21

UseReverseDNS off

PassivePorts 40000 40999

DebugLevel 0

SystemLog /var/log/proftpd/proftpd.log

UseIPv6 off

Umask 022

MaxInstances 30
MaxClients 50

User ftp
Group ftp

LogFormat default "%h %l %u %t \"%r\" %s %b"
LogFormat auth "%v [%P] %h %t \"%r\" %s"
LogFormat write "%h %l %u %t \"%r\" %s %b"

<Global>

# ------------------------------
# Login
# ------------------------------

ServerIdent on "FTP server on bitmachine1 ready"
DeferWelcome on
DisplayConnect /etc/proftpd/msg

<IfModule mod_ident.c>
IdentLookups off
</IfModule>
UseFtpUsers off
RequireValidShell off

TimeoutLogin 60
MaxLoginAttempts 3
#MaxClientsPerHost none
MaxClientsPerUser 3 "Only one connection at a time."

# ------------------------------
# Authentication
# ------------------------------

### PAM Authentication
# AuthPAM: default: on
AuthPAM off

# changed AuthPAMConfig file
AuthPAMConfig proftpd

AuthUserFile /etc/proftpd/auth/passwd
AuthGroupFile /etc/group

### order of auth modules
AuthOrder mod_sql.c mod_auth_file.c

AccessDenyMsg "Guest access denied for %u!"

# ------------------------------
# Post-Login
# ------------------------------

DisplayLogin /etc/proftpd/welcome.msg
DisplayChdir /etc/proftpd/.message
DisplayQuit /etc/proftpd/.quit
AllowOverride off

TimeoutIdle 600
TimeoutNoTransfer 900
TimeoutStalled 300
TimeoutSession 3600

# ------------------------------
# Session
# ------------------------------

DefaultRoot ~

DenyFilter \*.*/
ListOptions "-A +R" strict
UseGlobbing off

ShowSymlinks on
TimesGMT on

# ------------------------------
# Up- & Download
# ------------------------------

AllowOverwrite on
AllowRetrieveRestart on
HiddenStores on
DeleteAbortedStores on
#AllowStoreRestart off # is contrary to "DeleteAbortedStores"

# ------------------------------
# Logging
# ------------------------------

WtmpLog off
TransferLog /var/log/proftpd/xferlog

# Record all logins
ExtendedLog /var/log/proftpd/auth.log AUTH auth

# Logging file/dir access
ExtendedLog /var/log/proftpd/access.log WRITE,READ write

# Paranoia logging level....
ExtendedLog /var/log/proftpd/paranoid.log ALL default

# SQLLogFile - nicht bevor das MySQL-Modul geladen ist!
#SQLLogFile /var/log/proftpd/SQL.log

</Global>

<IfModule mod_dso.c>
# If mod_tls was built as a shared/DSO module, load it
LoadModule mod_tls.c
</IfModule>

<Limit SITE_CHMOD>
DenyAll
</Limit>

#####
# Include other confs
Include /etc/proftpd/conf.d/*.conf

#####

SQLAuthTypes Plaintext
SQLAuthenticate users
SQLConnectInfo ***@localhost root ??porrier_!
SQLDefaultGID 65533
SQLDefaultUID 65534
SQLMinUserGID 100
SQLMinUserUID 500
SQLUserInfo ftp username password uid gid homedir shell

SQLLogFile /var/log/proftpd/SQL.log

# xfer log in mysql
SQLLog RETR,STOR transfer1
SQLNamedQuery transfer1 INSERT "NULL, '%u', '%f', '%b', '%h', '%a', '%m', '%T', now(), '1'" ftpxferlog

SQLLOG ERR_RETR,ERR_STOR transfer2
SQLNamedQuery transfer2 INSERT "NULL, '%u', '%f', '%b', '%h', '%a', '%m', '%T', now(), '0'" ftpxferlog

Greetings

Andreas

Post by TJ Saunders

Post by Andreas Meyer
I have this in the proftpd.conf
SystemLog /var/log/proftpd/proftpd.log
but login attempts are logged to /var/log/messages.

Could you provide the full proftpd.conf?
Cheers,
TJ

[TJ Saunders]

Post by Andreas Meyer
I have this in the proftpd.conf
SystemLog /var/log/proftpd/proftpd.log
but login attempts are logged to /var/log/messages.
TransferLog /var/log/proftpd/xferlog
ExtendedLog /var/log/proftpd/auth.log AUTH auth
ExtendedLog /var/log/proftpd/access.log WRITE,READ write
ExtendedLog /var/log/proftpd/paranoid.log ALL default
Why is the SystemLog directive ignored and logging is done to
/var/log/messages? /var/log/proftpd/proftpd.log remains empty.

The configuration looks correct. The next thing to check, then, is that
your proftpd executable is actually using the config file you are
editing. (I have seen multiple cases where a config file other than
what was expected is actually used.)

To verify this, you can stop your proftpd, then start it using the -c
command-line option, specifying the full path to that configuration
file:

$ /usr/local/bin/proftpd -c /path/to/my/proftpd.conf

And see if that leads to the expected behavior. If that works, that you
may need to examine your proftpd init/start scripts, to see why they
might be pointing to a different proftpd.conf than the one you're
editing.

Hope this helps,
TJ

[Andreas Meyer]

Hello!

Post by TJ Saunders

Post by Andreas Meyer
I have this in the proftpd.conf
SystemLog /var/log/proftpd/proftpd.log
but login attempts are logged to /var/log/messages.
TransferLog /var/log/proftpd/xferlog
ExtendedLog /var/log/proftpd/auth.log AUTH auth
ExtendedLog /var/log/proftpd/access.log WRITE,READ write
ExtendedLog /var/log/proftpd/paranoid.log ALL default
Why is the SystemLog directive ignored and logging is done to
/var/log/messages? /var/log/proftpd/proftpd.log remains empty.

The configuration looks correct. The next thing to check, then, is that
your proftpd executable is actually using the config file you are
editing. (I have seen multiple cases where a config file other than
what was expected is actually used.)
To verify this, you can stop your proftpd, then start it using the -c
command-line option, specifying the full path to that configuration
$ /usr/local/bin/proftpd -c /path/to/my/proftpd.conf
And see if that leads to the expected behavior. If that works, that you
may need to examine your proftpd init/start scripts, to see why they
might be pointing to a different proftpd.conf than the one you're
editing.

Using your suggestion on the commandline specifying the proftpd.conf
writes to /var/log/proftpd/proftpd.log for the first time! Incredible.

I searched the whole system but there is just one proftpd.conf.

Why is SystemLog not used when starting with systemd
/usr/lib/systemd/system/proftpd.service

[Unit]
Description=ProFTPd FTP server
After=systemd-user-sessions.service network.target nss-lookup.target local-fs.target remote-fs.target

[Service]
ExecStart=/usr/sbin/proftpd --nodaemon
ExecReload=/bin/kill -HUP $MAINPID

[Install]
WantedBy=multi-user.target

says nothing about what config to use as far as i can see but it
uses the correct proftpd.conf obviously.

Greetings

Andreas