Search code examples
logparserproftpd

ProFTPD Extended Log - Use a subset of command classes instead of whole command class

I am building a log parser for ProFTPD and have a question regarding the ExtendedLog config directive.

Official ProFTPD documentation has the following ExtendedLog spec:

ExtendedLog [ filename [[command-classes] format-nickname]]

There are a couple of valid command-classes, but they are mostly consisted of groups of commands. For me, this is a problem because if a user uploads large file and if there are many users and many uploads, a WRITE command in extended log occurs for portions of the actual upload, meaning if a file is large, for that file WRITE occurs many times. This may fill up the log space fairly easily for large uploads. In comparison to this, STOR command can be visible only at the end of the actual file upload.

I can't explicitly find WRITE as one of the commands in the write command class but I was wondering if there is a way to omit this specific WRITE command from log as I'm only interested in a portion of commands from the write command class. The commands that I'm particularly and only interested in logging are STOR, DELE and RMD.

Many thanks.

Solution

  • At the end I did not found any flags in ProFTPD that could handle this but rather implemented log rotation.

    The log rotation restarts ProFTPD and sends interrupt to the log parser. Log parser then detects the interrupt, reads the current log file and then stops processing. Log rotate program then empties out the original log file.