Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Server: CentOS 5.2, Proftpd 1.3.3d, Logwatch 7.3-8.el5.noarch (updated with yum).

I've just setup Logwatch and got the email output, it does show some FTP info for example it shows uploaded and downloaded files. There are lots of failed FTP attempts in /var/log/secure but they are not shown in the Logwatch email.

It would be nice if Logwatch could list the IP's with the amount of attempts, is that possible? Would be nice to show successful logins too.


share|improve this question
up vote 0 down vote accepted

I had a similar problem with pure-ftpd, perhaps you could add the following line or similar to your /etc/syslog.conf:

# Save pure-ftpd messages to transfer.log
ftp.*                                                   /var/log/transfer.log

Only thing you have to do now is process those lines in your transfer.log using logwatch.

share|improve this answer
Will logwatch automatically pickup the transfer.log file though? – user69904 Feb 10 '11 at 14:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.