Documentation Center
AlienVault® USM Appliance™

ProFTPD

When you configure ProFTPD to send log data to USM Appliance, you can use the ProFTPD plugin to translate the raw log data into normalized events for analysis.

Device Details
Vendor ProFTPD
Device Type FTP Server
Connection Type Syslog
Data Source Name Proftpd
Data Source ID 1888

Integrating ProFTPD

Before you configure the ProFTPD integration, you must have the IP Address of the USM Appliance Sensor.

To configure ProFTPD to send Syslog messages to USM Appliance

By default, proftpd will capture FTP server log messages via syslog(3), using the daemon facility (and auth is also used for some logging). Log levels include: err, notice, warn, info, and debug. The location of the FTP server's log files is determined by your /etc/syslog.conf configuration.

Note: You can fine-tune proftpd syslog-based logging via the SyslogFacility and SyslogLevel directives. See the vendor log level documentation for more details on these settings.

Transfer logs (xferlogs) are not automatically sent to syslog, but you can include an ExtendedSyslog directive to include those messages. For example:

LogFormat xfer "%h %l %u %t\"%r\" %s %b"

ExtendedLog syslog:notice xfer

You also need to tell your syslog server to send log output to USM Appliance; to write log output to a log file.

The normal Linux syslog command uses the /etc/syslog.conf file (or similar) to configure how syslog streams operate. Since the Apache error log uses syslog-standard severity ratings, you can specify standard syslog configuration file settings to split syslog output into separate files based on severity.

To send log entries to the USM ApplianceSensor, include the following configuration file statements:

if $programname == 'proftpd' then @<USM Appliance_IP_address>

& stop

Plugin Enablement

For plugin enablement information, see Enable Plugins.

Additional Resources and Troubleshooting

http://www.proftpd.org/docs/howto/LogLevels.html

http://www.proftpd.org/docs/howto/Logging.html

For troubleshooting, refer to the vendor documentation:

http://www.proftpd.org/docs/faq/linked/faq-ch4.html