From OSSEC Wiki

Jump to: navigation, search
[edit]

Log Samples from vsftpd

If the system is using pam, authentication events from vsftp may also be logged in the pam format.
The following are from the vsftpd.log file.


  • Connection attempt:

Mon Jul 10 15:51:17 2006 [pid 26152] CONNECT: Client "192.168.2.10"


  • Failed login:

Mon Aug 21 14:33:24 2006 [pid 20175] [dcid] FAIL LOGIN: Client "127.0.0.1"


  • Login OK:

Mon Aug 21 14:37:23 2006 [pid 20293] [dcid] OK LOGIN: Client "127.0.0.1"


  • Anonymous login:

Mon Aug 21 14:32:06 2006 [pid 20127] [ftp] OK LOGIN: Client "127.0.0.1", anon password "lala@"


  • File upload:

Sun Aug 27 16:28:20 2006 [pid 13962] [xx] OK UPLOAD: Client "1.2.3.4", "/a.php", 8338 bytes, 18.77Kbyte/sec

Retrieved from "http://ossec.net/wiki/index.php/Vsftpd"
Views
Personal tools