Understanding Pure-FTP logs.

Hey all,
Wasn't sure if I should ask this in 'scripts' or 'backups' or what so I am entering in 'general'.

I am trying to find out how Pure-FTP logs are managed and/or retained. I see that when a client FTP's to the server, their transfers are stored in /usr/local/apache/domlogs/ftpxferlog. At some point that log is scanned and the entries are stored in their respective ftp.domain-ftp_log files (I am assuming based on the ftp users name).

It seems like both the ftpxferlog is cleared and the ftp.domain-ftp_log is either overwritten or the new entries from ftpxferlog are simply dropped when this happens. I am guessing the ftp.domain-ftp_log is overwritten when the parse script detects a new date? The new entries appear to be dropped if there are already entries?? This does not seem like a very effective method to allow for log analysis.

I am wondering the best method for retaining logs. I asked via a cPanel ticket as it was suggested that in Tweak Settings, I could enable "Keep log files at the end of the month (default is off as you can run out of disk space quickly)" though that warning raised a flag. I also see in Tweak Settings, a mention of not clearing ftpxferlog.

If I set Tweak Settings to not clear ftpxferlog and instead clear it myself when I want, will the parser then be able to break the domain based stats into seperate files and retain results for as long as the ftpxferlog has entries?

Thanks in advance for any feedback. I would like to be able to retain the ftp logs to help/prove to customers why files seem to have changed. If I cannot show them an ftp was done, they will not admit to having done it!

--
Colin

 

I do not have any FTP information stored in /var/log/messages. I like the idea of having the FTP logs separated into their respective files, I would just like to be able to retain the information for longer periods and more accurately.