Proftpd who is connecting?

I noticed on a server of mine there are a bunch of proftpd processes
running, causing the server's load to skyrocket. How do I find out which
site that I host on the server is responsible for this?

On 2005-06-06, Shabam <(E-Mail Removed)> wrote:
> I noticed on a server of mine there are a bunch of proftpd processes
> running, causing the server's load to skyrocket. How do I find out which
> site that I host on the server is responsible for this?

Checking the log files of the proftp server?
Davide

--
More systems have been wiped out by admins than any hacker could do
in a lifetime. - Rick Furniss

maybe check /var/log/xferlog?

> Checking the log files of the proftp server?

If only it were that simple. The server is hosting hundreds of customer
sites, and each one has its own ftp log file. Is there another way to
figure out which account is responsible for this?

Shabam wrote:
>>Checking the log files of the proftp server?
>
>
> If only it were that simple. The server is hosting hundreds of customer
> sites, and each one has its own ftp log file. Is there another way to
> figure out which account is responsible for this?

Write a script to parse the log files for excessive traffic; if you have
"hundreds of sites" running on the box you should already have this
stuff in place...


--
J

www.gentoo.org - not just for geeks anymore.

On Tue, 07 Jun 2005 04:06:21 -0700, Shabam wrote:

>> Checking the log files of the proftp server?
>
> If only it were that simple. The server is hosting hundreds of customer
> sites, and each one has its own ftp log file. Is there another way to
> figure out which account is responsible for this?

you can ps aux | grep ftp to see a list of the ftp connections and who's
on them - assuming of course you're not using anonymous. You'll be able
to see CPU, memory and time amongst other stats.