0

following config rules:

auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
#cron.*                         /var/log/cron.log
daemon.*                        -/var/log/daemon.log
ftp.*                           /var/log/vsftpd.log

First 2 lines mean, log everything to syslog except auth and authpriv, log them to auth.log. Cron log is disabled by comment, daemon.* is in both syslog and daemon.log.

ftp.* logs to syslog but not to vsftpd.log, why?

what is the "-" prependet to the path?

I read the manpages but could not find information 'bout that.

Improve this question

1 Answer 1

Reset to default
2

The ftp facility will end up being ignored if your platform does not define LOG_FTP. This is probably the reason why -- it's interesting to note that ftp isn't included as a valid facility in the rsyslog.conf manpage, most likely to avoid having to explain it.

* Mon Oct 12 18:29:44 CEST 1998: Martin Schulze <[email protected]>
*      Added `ftp' facility which was introduced in glibc version 2.
*      It's #ifdef'ed so won't harm with older libraries.

Looking at the source code, you can see where this happens in runtime/srutils.c:

syslogName_t    syslogFacNames[] = {
    {"auth",         LOG_AUTH},
    {"authpriv",     LOG_AUTHPRIV},
    {"cron",         LOG_CRON},
    {"daemon",       LOG_DAEMON},
    {"kern",         LOG_KERN},
    {"lpr",          LOG_LPR},
    {"mail",         LOG_MAIL},
    {"mark",         LOG_MARK},             /* INTERNAL */
    {"news",         LOG_NEWS},
    {"security",     LOG_AUTH},             /* DEPRECATED */
    {"syslog",       LOG_SYSLOG},
    {"user",         LOG_USER},
    {"uucp",         LOG_UUCP},
#if defined(LOG_FTP)
    {"ftp",          LOG_FTP},
#endif
    {"local0",       LOG_LOCAL0},
    {"local1",       LOG_LOCAL1},
    {"local2",       LOG_LOCAL2},
    {"local3",       LOG_LOCAL3},
    {"local4",       LOG_LOCAL4},
    {"local5",       LOG_LOCAL5},
    {"local6",       LOG_LOCAL6},
    {"local7",       LOG_LOCAL7},
    {NULL,           -1},
};

The - behavior is a bit nuanced. You'll need three URLs for the complete picture.

The short version: as of V3, a - prefix by itself specifies if you want a file to be omitted from disk syncing, but this is only meaningful if syncing has been enabled at all with $ActionFileEnableSync on.

It's still useful to include the syntax in your configuration if you operate with a mixed syslog daemon environment and there is a practice of sharing compatible configs between servers.

Improve this answer
4
  • Nice explanation, tyvm. I wonder why the facilities ( auth, authpriv, cron, daemon, kern, lpr, mail, mark, news, security (same as auth), syslog, user, uucp and local0 through local7) are so limited? In vsftpd man it sais "syslog_enable If enabled, then any log output which would have gone to /var/log/vsftpd.log goes to the system log instead. Logging is done under the FTPD facility." Even with ftpd instead of ftp it does not work..
    – Daniel W.
    Jan 22, 2013 at 10:57
  • I think I see what's going on, I've updated my answer. The answer is probably going to end up being your OS.
    – Andrew B
    Jan 22, 2013 at 11:11
  • How can I test weather LOG_FTP is defined? Using Debian 6.0.6, rsyslogd 4.6.4
    – Daniel W.
    Jan 22, 2013 at 11:31
  • That should definitely be recent enough to define LOG_FTP. Did rsyslog generate a 0 byte FTP log when you restarted the daemon? If so, try the following and see if it gets logged. logger -p ftp.info test If that works, you need to reconfigure vsftpd to actually use syslog.
    – Andrew B
    Jan 24, 2013 at 21:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .