Re: [Proftpd-user] Logging confusion
> Is it true that you can have only one TransferLog destination, unlike
> ExtendedLog where you could have multiple destinations by using
> multiple ExtendedLog directives?[/color]
> If so then to do a 'tee' of TransferLog you would have to first
> direct output to a FIFO, then have another program output to the
> desired multiple destinations? (And also implement the security
> checks on those output destinations, e.g. ownership, permissions,
> And so if external program dies/fails/flubs then no transfer logging
> is done?[/color]
It depends on how this external program dies, exactly. If the
FIFO-reading program dies, then the TransferLog lines written in that time
will be lost.
> Is there any "good way" to implement multiple consumers of
> TransferLog without having them all monitor a single external file?[/color]
In the past, when I've had to do such things, I wrote TransferLog
post-processing scripts. This works well -- as long as you have no
real-time requirements with regard to the handling of TransferLog lines.
> Has anyone tried duplicating the ExtendedLog output using
> SQLLog? That is, would
> SQLLog STOR,RETR,DELE dwiw
> SQLNamedQuery dwiw INSERT "NULL, '%h', '%l', '%u', now(), '%r',
> '%s', '%b'" mysqlextlog
Yes, it should.
> How about duplicating (or approximating) TransferLog using SQLLog?
> SQLLog STOR xflstorgood
> SQLNamedQuery xflstorgood "NULL, now(), '%T', '%h', '%b', '%f',
> '??type??', '??action??', 'i', 'r', '%u', 'ftp', '0', '*', 'c'" mysqlxflg
> SQLLog ERR_STOR xflstorbad
> SQLNamedQuery xflstorbad "NULL, now(), '%T', '%h', '%b', '%f',
> '??type??', '??action??', 'i', 'r', '%u', 'ftp', '0', '*', 'i'" mysqlxflg
> SQLLog RETR xflretrgood
> SQLNamedQuery xflretrgood "NULL, now(), '%T', '%h', '%b', '%f',
> '??type??', '??action??', 'o', 'r', '%u', 'ftp', '0', '*', 'c'" mysqlxflg
The TYPE command should be logged using SQL, if desired, using:
SQLLog TYPE <name>
SQLNamedQuery <name> "%r" mysqllog
I'm not sure what you mean by "action" in the above. If you are referring
to the "special action flag", then it would always be "-"; proftpd doesn't
handle compressing, uncompressing, or tar'ing of files (as wu-ftpd does)
Also, in the above, I would include an ERR_RETR SQLLog directive, for
In addition, to thread all of the above logging together, I would
suggest using the mod_unique_id module, newly added in proftpd-1.3.2rc1,
to include a session ID with the inserted data; see
doc/contrib/mod_unique_id.html in the proftpd-1.3.2rc1 source tarball.
Solitude vivifies; isolation kills.
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
ProFTPD Users List <email@example.com>