Configuring audit of ProFTPD events.

To configure event audit in the ProFTPD system:

1. Create a backup copy of the /etc/proftpd/proftpd.conf configuration file.
2. Edit the proftpd.conf file to add or change the following settings:

   LogFormat default "%t %a %A %b %F %H %h %l %u \"%r\" %s %{file-modified} %{gid} %{transfer-status}"

   LogFormat auth "%t %a %A %b %F %H %h %l %u \"%r\" %s %{file-modified} %{gid} %{transfer-status}"

   ExtendedLog /var/log/proftpd/access.log ALL default

   ExtendedLog /var/log/proftpd/auth.log AUTH auth

3. Save changes and restart the service by running the following command:

   sudo systemctl restart proftpd

Audit of ProFTPD events is configured.

ProFTPD does not perform log rotation. To reduce the risk of disk space filling up, we recommend using an external log rotation tool such as Logrotate or Logadm.

Page top