In troubleshooting what happened to my user's "User" dir, I went out looking for proftpd's log files. I found a couple of intesting things: 1) /etc/proftpd.conf contains: TransferLog /var/log/proftpd_xfer.log SystemLog /var/log/proftpd_sys.log but when I look in /var/log I see: -rw-r----- 1 root root 224278768 2007-11-19 14:22 proftpd_sys.log -rw-r--r-- 1 root root 726 2007-11-06 16:46 proftpd_xfer.log It looks like proftpd is actually recording transfers in /var/log/xferlog. Any idea why, given the above lines in /etc/proftpd.conf? I suspect that I'm just overly tired and am overlooking something obvious. 2) When looking through ispconfig.log I see messages similar to: 18.11.2007 - 23:59:03 => INFO - /root/ispconfig/scripts/shell/ftp_logs.php, Line 96: cat /dev/null > /var/log/xferlog.www.varmints.info 18.11.2007 - 23:59:03 => INFO - /root/ispconfig/scripts/shell/ftp_logs.php, Line 121: rm -f /var/log/xferlog.www.varmints.info for each of the domains on my server. I'm not exactly sure what this is doing. If I read it correctly it's creating an empty file named /var/log/xferlog.www.(domain name) then deleting that empty file. Reasons for this? In looking at my system all I can figure is the mail admin user must have made an FTP connection, cd'd into "user", not expected to see all the user dirs so deleted them. That's the only way I can figure user dirs would have gotten deleted without users being removed from the database.
1) thats ok. I guess proftpd logs to syslog as well. 2) Thats fine too. This is from the ftp traffic stats script.