LinuxQuestions.org
Register a domain and help support LQ
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices

Reply
 
Search this Thread
Old 11-06-2009, 04:32 PM   #1
rjo98
Senior Member
 
Registered: Jun 2009
Location: US
Distribution: RHEL, CentOS
Posts: 1,525

Rep: Reputation: 37
Does VSFTP log when people upload/download from server?


Does VSFTP log when people upload/download from server? I have a case where someone swears they uploaded some files to our ftp site, but the people who pull the files down say they were never there. I'd like to solve the he said she said debate with some proof if i can find it, but I don't even know where to look or if its even possible to have this stuff logged?
 
Old 11-06-2009, 04:36 PM   #2
bathory
Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 10,909

Rep: Reputation: 1326Reputation: 1326Reputation: 1326Reputation: 1326Reputation: 1326Reputation: 1326Reputation: 1326Reputation: 1326Reputation: 1326Reputation: 1326
Hi,

You can check /etc/vsftpd.conf to see if logging is enabled and the location/name of the logfile.

Regards
 
Old 11-06-2009, 04:53 PM   #3
rjo98
Senior Member
 
Registered: Jun 2009
Location: US
Distribution: RHEL, CentOS
Posts: 1,525

Original Poster
Rep: Reputation: 37
Great, it did log all the ins and outs. now if only i could find out if someone deleted the files or not, i see they were uploaded successfully.
 
Old 11-06-2009, 05:15 PM   #4
bathory
Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 10,909

Rep: Reputation: 1326Reputation: 1326Reputation: 1326Reputation: 1326Reputation: 1326Reputation: 1326Reputation: 1326Reputation: 1326Reputation: 1326Reputation: 1326
If the files were deleted from inside an ftp session, you cannot find who deleted them, unless you had the following 2 options set in vsftpd.conf
Code:
log_ftp_protocol=YES
xferlog_std_format=NO
In that case the debug logs are written to /var/log/vsftpd.log by default.
If you suspect the files were deleted from cli (or an ssh session), you can check the user's history, if he/she was not clever enough to clear it.

Regards
 
Old 11-06-2009, 05:23 PM   #5
rjo98
Senior Member
 
Registered: Jun 2009
Location: US
Distribution: RHEL, CentOS
Posts: 1,525

Original Poster
Rep: Reputation: 37
I have the xferlog_std_format set to YES right now. I read the description in the file for that one and don't understand what that's for.

I don't even have the log_ftp_protocol in my current file. is that bad?
 
Old 11-06-2009, 05:32 PM   #6
bathory
Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 10,909

Rep: Reputation: 1326Reputation: 1326Reputation: 1326Reputation: 1326Reputation: 1326Reputation: 1326Reputation: 1326Reputation: 1326Reputation: 1326Reputation: 1326
Quote:
Originally Posted by rjo98 View Post
I have the xferlog_std_format set to YES right now. I read the description in the file for that one and don't understand what that's for.
I don't even have the log_ftp_protocol in my current file. is that bad?
No, these 2 options are used for debugging reasons, if they set to NO and YES respectively. In normal operation you need only to see the file transfers and not all the stuff that is logged for debugging, so you have to disable the log_ftp_protocol.
Of course this way you cannot tell if someone deleted any files using ftp.
 
Old 11-06-2009, 05:52 PM   #7
rjo98
Senior Member
 
Registered: Jun 2009
Location: US
Distribution: RHEL, CentOS
Posts: 1,525

Original Poster
Rep: Reputation: 37
OK, thanks for the info. I guess for now i'll keep it as is, but at least I know how to change it for the future. Thanks for all the help!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Upload file to ftp server -vsftp- but can not delete or change the file once uploaded murattas6 Linux - Server 2 06-26-2009 06:00 AM
FTP server only root can log in no one else ? vsftp slackware zonemikel Linux - Server 3 03-25-2008 11:32 AM
Vsftp Upload/Download permission acbenny Linux - Networking 7 08-02-2004 03:31 PM
Vsftp upload/download permission acbenny Linux - General 0 07-28-2004 10:17 AM
VSFTP allowing upload/download but not DELETE joelf Red Hat 2 09-25-2003 12:05 PM


All times are GMT -5. The time now is 04:55 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration