Your IP : 3.21.21.220
<!DOCTYPE html>
<html>
<head>
<title>ProFTPD Logging: Log Messages</title>
</head>
<body bgcolor=white>
<hr>
<center><h2><b>ProFTPD Logging: Log Messages</b></h2></center>
<hr>
<p>
<b>Log Messages</b>
This document attempts to list the most common messages logged (either via
<code>syslog</code> or the <code>SystemLog</code> file), grouped by the
<a href="LogLevels.html">log level</a> for the message.
<p><a name="EMERG">
<b><code>EMERG</code> Log Messages</b><br>
There are currently no <code>EMERG</code>-level messages logged by
<code>proftpd</code>.
<p><a name="ALERT">
<b><code>ALERT</code> Log Messages</b><br>
<code>ALERT</code>-level messages are logged by <code>proftpd</code> when a
crucial system resource (<i>e.g.</i> memory, CPU, file descriptors, disk
space) has been exhausted.
<ul>
<li>"Out of memory!"<br>
This log message can be generated by various core subsystems and modules,
and indicates that <code>proftpd</code> could not allocate enough memory.
</li>
<p>
<li>"unable to fork"<br>
This log message indicates that <code>proftpd</code> tried to fork a new
process (<i>e.g.</i> to read passphrases, execute a script, <i>etc</i>) and
failed. This can happen when the process table is full, or when there is
not enough system memory to create a new process.
</li>
<p>
<li>"cannot write ExtendedLog", <i>or</i> "failed to write <em>file</em>: No space on device"<br>
These log messages indicate that the filesystem on which the files are
being written is out of space.
</li>
</ul>
<p><a name="CRIT">
<b><code>CRIT</code> Log Messages</b><br>
There are currently no <code>CRIT</code>-level messages logged by
<code>proftpd</code>.
<p><a name="ERR">
<b><code>ERR</code> Log Messages</b><br>
<code>ERR</code>-level messages are logged by <code>proftpd</code> when
<code>proftpd</code> cannot start up because it cannot use the given
configuration for some reason: no DNS resolution for hostnames, unable to listen
on addresses/ports, or necessary cryptographics keys/certs are unusable.
<ul>
<li>Failed binding to <i>address</i>, port <i>port</i><br>
Check the ServerType directive to ensure you are configured correctly<br>
Check to see if inetd/xinetd, or another proftpd instance, is already using <i>address</i>, port <i>port</i><br>
<br>
When <code>proftpd</code> starts up, it will attempt to bind sockets to,
and listen on, all of the configured addresses/ports. If it cannot bind
to an address/port, the above message is logged. As mentioned in the log
message, the most common cause is that another <code>proftpd</code> daemon
is running and is using the address/port, <i>or</i> that
<code>inetd/xinetd</code> is using the address/port because your FTP
server is supposed to be run that way; if so, check that the
<a href="ServerType.html"><code>ServerType</code></a> in the
<code>proftpd.conf</code> file is "inetd" and not "standalone".
</li>
<p>
<li>"unable to listen on <i>address</i>#<i>port</i>"<br>
When <code>proftpd</code> starts up, it will attempt to bind sockets to,
and listen on, all of the configured addresses/ports. If it cannot listen
on an address/port, the above message is logged. The most common cause of
this message is the use of different DNS names in
<code><VirtualHost></code> sections which resolve to the same IP
address(es). FTP, unlike HTTP, only deals with IP addresses, and thus
<code>proftpd</code> resolves the <code><VirtualHost></code> DNS name
to its IP address, then listens on that address. If two different
<code><VirtualHost></code> sections have different DNS names which
resolve to the same IP address, then the first section will get the
address, and listening to the second address will fail (probably with the
"Address already in use" error).
</li>
<p>
<li>"(Running from command line? Use `ServerType standalone' in config file!)"<br>
This log message almost always happen when you have "ServerType inetd" in
your <code>proftpd.conf</code>, <b>but</b> you are attempting to start
<code>proftpd</code> from the command line (or some init script). Chances
are that you do not really want to be doing this; if you do, see the
<a href="ServerType.html"><code>ServerType</code></a> docs for more
information.
</li>
<p>
<li>"unable to accept incoming connection"<br>
The server cannot accept a TCP connection from a remote client; the most
likely cause is too many open files (which includes sockets) and hitting
the per-process, or the system-wide, open file limit.
</li>
<p>
<li>"chroot to <em>directory</em> failed for user <em>name</em>"<br>
Restricting users via the <a href="Chroot.html">DefaultRoot</a> directive
requires that the logging-in user have the <i>execute</i> permission on
the target directory. Without that permission -- or if there are other
filesystem permission errors -- the above message will be logged.
</li>
<p>
<li>"RELINQUISH PRIVS", "REVOKE PRIVS", "ROOT PRIVS", "SETUP PRIVS", "USER PRIVS", "unable to set UID/GID"</br>
These log messages indicate that changing the UID/GID of the current
process (as during authentication, or the handling of
<a href="../modules/mod_core.html#UserOwner"><code>UserOwner</code></a>/<a href="../modules/mod_core.html#GroupOwner"><code>GroupOwner</code></a>
directives) has failed for some reason. The most common cause of these
messages is starting <code>proftpd</code> as a non-root user.
</li>
<p>
<li>"unable to open <em>log-file</em>: <em>parent-dir</em> is a world-writable directory"<br>
These log messages indicate that your logging configuration <b>is
insecure</b>. Log files in a world-writable directory can be deleted or
modified by <b>any user on the system</b>, which means that your logged
data cannot be trusted. For this reason, <code>proftpd</code> refuses to
write log files to such directories.
</li>
<p>
<li>"unable to open <em>log-file</em>: <em>log-file</em> is a symbolic link"<br>
These log messages indicate that your logging configuration <b>may</b> be
insecure. Symbolic links are subject to race conditions, where a local
user on the system might try to replace portions of the symlink path with
their own directories, changing the symlink to point somewhere else, such
as causing the log file to overwrite an existing file (<i>e.g.</i>
<code>/etc/passwd</code>).
<p>
For this reason, <code>proftpd</code> refuses to write log files to
symlinks, unless configured to do so via the <a href="../modules/mod_log.html#AllowLogSymlinks"><code>AllowLogSymlinks</code></a> directive.
</li>
<p>
<li>"unable to open <em>log-file</em>"<br>
These log messages indicate that the log file could be not used for some
other reason, such as lack of permissions or nonexistent directories.
</li>
<p>
<li>"mod_sql: unrecoverable backend error"<br>
Backend database server (<i>e.g.</i> MySQL, Postgres, SQLite, <i>etc</i>)
rejected the SQL statement being executed. This usually happens when a
table or column in the SQL statement does not exist, or if the table/column
names have a typo/mismatch between the config file and database server.
</li>
<p>
<li>"error: unable to set groups: Invalid argument"<br>
Setting the list of GIDs to use for the logged-in user uses the
<code>setgroups(2)</code> system call, which has some restrictions. Most
notably, attempting to make the user be a member of too many groups will
cause the above error. The maximum number of groups varies from platform
to platform, but can be anywhere from 4 to 32 (or more).
</li>
<p>
<li>"error opening scoreboard"<br>
The <a href="Scoreboard.html"><code>ScoreboardFile</code></a> is needed for
useful things like <code>ftpwho</code> and <code>ftptop</code>, thus if the
path cannot be opened, <code>proftpd</code> will fail to start. The most
common cause for this failure is that the configured
<code>ScoreboardFile</code> is in a directory which does not exist; the
parent directory <b>must</b> exist prior to starting <code>proftpd</code>.
</li>
<p>
<li>"Malformed entry in AuthUserFile/AuthGroupFile"<br>
The configured <a href="AuthFiles.html">AuthUserFile/AuthGroupFile</a>
has a line which is not in the necessary format. The most common cause
for this is when one of the file fields is missing, or if there an extra
colon (':') character in a field (<i>e.g.</i> in the name field).
</li>
</ul>
<p><a name="WARNING">
<b><code>WARNING</code> Log Messages</b><br>
<p><a name="NOTICE">
<b><code>NOTICE</code> Log Messages</b><br>
<p><a name="INFO">
<b><code>INFO</code> Log Messages</b><br>
<code>INFO</code>-level messages are logged by <code>proftpd</code> when
common events happen: a connection session begins/ends, a user logs in,
idle connections are dropped, <i>etc</i>.
<ul>
<li>"FTP/SSH2 session opened/closed"<br>
When a client connects, a session process begins. The type of session
(<i>i.e.</i> FTP, SSH2, <i>etc</i>) is determined by the server to which
the client connected.
</li>
<p>
<li>"USER <i>user</i>: Login successful" <i>or</i> "ANON <i>user</i>: Login successful"<br>
Successful authentication (via password, or anonymously) happened, as
opposed to a failed authentication/login.
</li>
<p>
<li>"<i>address</i>:<i>port</i> masquerading as <i>address</i>"<br>
This message is logged when the <a href="../modules/mod_core.html#MasqueradeAddress"><code>MasqueradeAddress</code></a> directive is in effect.
</li>
<p>
<li>"Client session idle timeout, disconnected"<br>
The configured <a href="../modules/mod_core.html#TimeoutIdle"><code>TimeoutIdle</code></a> was reached while the client did nothing useful, and so the
client had to be disconnected. This is quite common/normal.
</li>
<p>
<li>"mod_dso: module <i>name</i> already loaded"<br>
This log message happens when a <a href="../modules/mod_dso.html#LoadModule"><code>LoadModule</code></a> directive attempts to load a module which has
already been loaded, either by a previous <code>LoadModule</code> directive
<i>or</i> because the named module is a static module (and is thus always
"loaded"). Either way, this log message indicates that the configuration
has redundant <code>LoadModule</code> directives which can be removed.
</li>
</ul>
<p><a name="DEBUG">
<b><code>DEBUG</code> Log Messages</b><br>
There are many <code>DEBUG</code>-level messages logged by
<code>proftpd</code>. This section will be filled, over time, with the
ones most commonly seen/asked about by users.
<p><a name="strerror">
Many of the reasons for various errors/failures that appear in log messages
(and elsewhere) come from the <code>strerror(3)</code> libc function, which
provides human readable strings, given a numeric <code>errno</code> value.
The table below lists the reason strings you may commonly see, with a fuller
description of what it means.
<p>
<table border=1 summary="Error Messages">
<tr>
<td><b>Message</b></td>
<td><b>Code</b></td>
<td><b>Details</b></td>
</tr>
<tr>
<td> Operation not permitted </td>
<td> <code>EPERM</code> </td>
<td>Indicates that the requested operation cannot be done for some reason,
usually caused by misconfigurations or lack of system support/resources.
Note: Some platforms (<i>e.g.</i> Solaris) actually translate the
<code>EACCES</code> code to this message, which is confusing.
</td>
</tr>
<tr>
<td> Permission denied </td>
<td> <code>EACCES</code> </td>
<td>Means that the request operation is not allowed due to access controls:
the logged-in user does not have sufficient filesystem permissions
to open/read/write/delete a file/directory, the logged-in user (or
client) is barred from access by configuration, <i>etc</i>.
</td>
</tr>
<tr>
<td> Invalid argument </td>
<td> <code>EINVAL</code> </td>
<td>This generic message indicates that the supplied parameters are
considered invalid; the reasons behind this are myriad, depending on
the requested operation.
</td>
</tr>
<tr>
<td> No such file or directory </td>
<td> <code>ENOENT</code> </td>
<td>The requested resource does not exist; can apply to files,
directories, and other non-filesystem resources.
</td>
</tr>
<tr>
<td> Is a directory </td>
<td> <code>EISDIR</code> </td>
<td>The requested operation expects to operate on a file, but the
requested resource was a directory, not a file.
</td>
</tr>
<tr>
<td> Bad file descriptor </td>
<td> <code>EBADF</code> </td>
<td>Read/write/close/delete operation on a file was requested on a
file descriptor which was not already opened.
</td>
</tr>
<tr>
<td> Address already in use </td>
<td> <code>EADDRINUSE</code> </td>
<td>Process is attempting to listen on a network address/port which is
already bound; usually some other process on the system is listening
on that address (<i>e.g.</i> <code>inetd</code>/<code>xinetd</code>).
</td>
</tr>
<tr>
<td> Broken pipe </td>
<td> <code>EPIPE</code> </td>
<td>Process tried to send something to a connected TCP peer, and found
out that the connection had already been closed; can happen when
a firewall/router/NAT between TCP peers silently closes the connection
without informing one or both peers.
</td>
</tr>
<tr>
<td> Connection reset by peer </td>
<td> <code>ECONNRESET</code> </td>
<td>Remote TCP peer sent the <code>RST</code> TCP flag, indicating that
the connection should be reset; this almost always indicates an
issue with the connected client (or some firewall/router/NAT device
between the client and the server).
</td>
</tr>
<tr>
<td> Connection refused </td>
<td> <code>ECONNREFUSED</code> </td>
<td>The remote peer refused to accept the TCP connection; could be
firewalls/routers/NATs in the way, other network ACLs that deny the
connection, <i>etc</i>.
</td>
</tr>
<tr>
<td> Too many open files </td>
<td> <code>EMFILE</code> </td>
<td><b>Per-process</b> limit of number of open files (including sockets)
has been reached.
</td>
</tr>
<tr>
<td> Too many open files in system </td>
<td> <code>ENFILE</code> </td>
<td><b>System-wide</b> limit of number of open files (including sockets)
has been reached.
</td>
</tr>
</table>
<p>
<hr>
<font size=2><b><i>
© Copyright 2013-2017 The ProFTPD Project<br>
All Rights Reserved<br>
</i></b></font>
<hr>
</body>
</html>