Log Messages
This document attempts to list the most common messages logged (either via
syslog or the SystemLog file), grouped by the
log level for the message.
 
 
   
   
 
 
   
   
   
   
   
   
   
    For this reason,  
    
   
   
   
   
 
 
 
   
   
   
  EMERG Log Messages
There are currently no EMERG-level messages logged by
proftpd.
ALERT Log Messages
ALERT-level messages are logged by proftpd when a
crucial system resource (e.g. memory, CPU, file descriptors, disk
space) has been exhausted.
  
    This log message can be generated by various core subsystems and modules,
    and indicates that proftpd could not allocate enough memory.
  
    This log message indicates that proftpd tried to fork a new
    process (e.g. to read passphrases, execute a script, etc) and
    failed.  This can happen when the process table is full, or when there is
    not enough system memory to create a new process.
  
    These log messages indicate that the filesystem on which the files are
    being written is out of space.
  CRIT Log Messages
There are currently no CRIT-level messages logged by
proftpd.
ERR Log Messages
ERR-level messages are logged by proftpd when
proftpd cannot start up because it cannot use the given
configuration for some reason: no DNS resolution for hostnames, unable to listen
on addresses/ports, or necessary cryptographics keys/certs are unusable.
  
      Check the ServerType directive to ensure you are configured correctly
      Check to see if inetd/xinetd, or another proftpd instance, is already using address, port port
    
    When proftpd starts up, it will attempt to bind sockets to,
    and listen on, all of the configured addresses/ports.  If it cannot bind
    to an address/port, the above message is logged.  As mentioned in the log
    message, the most common cause is that another proftpd daemon
    is running and is using the address/port, or that
    inetd/xinetd is using the address/port because your FTP
    server is supposed to be run that way; if so, check that the
    ServerType in the
    proftpd.conf file is "inetd" and not "standalone".
  
    When proftpd starts up, it will attempt to bind sockets to,
    and listen on, all of the configured addresses/ports.  If it cannot listen
    on an address/port, the above message is logged.  The most common cause of
    this message is the use of different DNS names in
    <VirtualHost> sections which resolve to the same IP
    address(es).  FTP, unlike HTTP, only deals with IP addresses, and thus
    proftpd resolves the <VirtualHost> DNS name
    to its IP address, then listens on that address.  If two different
    <VirtualHost> sections have different DNS names which
    resolve to the same IP address, then the first section will get the
    address, and listening to the second address will fail (probably with the
    "Address already in use" error).
  
    This log message almost always happen when you have "ServerType inetd" in
    your proftpd.conf, but you are attempting to start
    proftpd from the command line (or some init script).  Chances
    are that you do not really want to be doing this; if you do, see the
    ServerType docs for more
    information.
  
    The server cannot accept a TCP connection from a remote client; the most
    likely cause is too many open files (which includes sockets) and hitting
    the per-process, or the system-wide, open file limit.
  
    Restricting users via the DefaultRoot directive
    requires that the logging-in user have the execute permission on
    the target directory.  Without that permission -- or if there are other
    filesystem permission errors -- the above message will be logged.
  UserOwner/GroupOwner
    directives) has failed for some reason.  The most common cause of these
    messages is starting proftpd as a non-root user.
  
    These log messages indicate that your logging configuration is
    insecure.  Log files in a world-writable directory can be deleted or
    modified by any user on the system, which means that your logged
    data cannot be trusted.  For this reason, proftpd refuses to
    write log files to such directories.
  
    These log messages indicate that your logging configuration may be
    insecure.  Symbolic links are subject to race conditions, where a local
    user on the system might try to replace portions of the symlink path with
    their own directories, changing the symlink to point somewhere else, such
    as causing the log file to overwrite an existing file (e.g.
    /etc/passwd).
    proftpd refuses to write log files to
    symlinks, unless configured to do so via the AllowLogSymlinks directive.
  
    These log messages indicate that the log file could be not used for some
    other reason, such as lack of permissions or nonexistent directories.
  
    Backend database server (e.g. MySQL, Postgres, SQLite, etc)
    rejected the SQL statement being executed.  This usually happens when a
    table or column in the SQL statement does not exist, or if the table/column
    names have a typo/mismatch between the config file and database server.
  
    Setting the list of GIDs to use for the logged-in user uses the
    setgroups(2) system call, which has some restrictions.  Most
    notably, attempting to make the user be a member of too many groups will
    cause the above error.  The maximum number of groups varies from platform
    to platform, but can be anywhere from 4 to 32 (or more).
  
    The ScoreboardFile is needed for
    useful things like ftpwho and ftptop, thus if the
    path cannot be opened, proftpd will fail to start.  The most
    common cause for this failure is that the configured
    ScoreboardFile is in a directory which does not exist; the
    parent directory must exist prior to starting proftpd.
  
    The configured AuthUserFile/AuthGroupFile
    has a line which is not in the necessary format.  The most common cause
    for this is when one of the file fields is missing, or if there an extra
    colon (':') character in a field (e.g. in the name field).
  WARNING Log Messages
NOTICE Log Messages
INFO Log Messages
INFO-level messages are logged by proftpd when
common events happen: a connection session begins/ends, a user logs in,
idle connections are dropped, etc.
  
    When a client connects, a session process begins.  The type of session
    (i.e. FTP, SSH2, etc) is determined by the server to which
    the client connected.
  
    Successful authentication (via password, or anonymously) happened, as
    opposed to a failed authentication/login.
  
    This message is logged when the MasqueradeAddress directive is in effect.
  
    The configured TimeoutIdle was reached while the client did nothing useful, and so the
    client had to be disconnected.  This is quite common/normal.
  
    This log message happens when a LoadModule directive attempts to load a module which has
    already been loaded, either by a previous LoadModule directive
    or because the named module is a static module (and is thus always
    "loaded").  Either way, this log message indicates that the configuration
    has redundant LoadModule directives which can be removed.
  
| Message | Code | Details | 
| Operation not permitted | EPERM | Indicates that the requested operation cannot be done for some reason,
        usually caused by misconfigurations or lack of system support/resources.
        Note: Some platforms (e.g. Solaris) actually translate the EACCEScode to this message, which is confusing. | 
| Permission denied | EACCES | Means that the request operation is not allowed due to access controls: the logged-in user does not have sufficient filesystem permissions to open/read/write/delete a file/directory, the logged-in user (or client) is barred from access by configuration, etc. | 
| Invalid argument | EINVAL | This generic message indicates that the supplied parameters are considered invalid; the reasons behind this are myriad, depending on the requested operation. | 
| No such file or directory | ENOENT | The requested resource does not exist; can apply to files, directories, and other non-filesystem resources. | 
| Is a directory | EISDIR | The requested operation expects to operate on a file, but the requested resource was a directory, not a file. | 
| Bad file descriptor | EBADF | Read/write/close/delete operation on a file was requested on a file descriptor which was not already opened. | 
| Address already in use | EADDRINUSE | Process is attempting to listen on a network address/port which is
        already bound; usually some other process on the system is listening
        on that address (e.g. inetd/xinetd). | 
| Broken pipe | EPIPE | Process tried to send something to a connected TCP peer, and found out that the connection had already been closed; can happen when a firewall/router/NAT between TCP peers silently closes the connection without informing one or both peers. | 
| Connection reset by peer | ECONNRESET | Remote TCP peer sent the RSTTCP flag, indicating that
        the connection should be reset; this almost always indicates an
        issue with the connected client (or some firewall/router/NAT device
        between the client and the server). | 
| Connection refused | ECONNREFUSED | The remote peer refused to accept the TCP connection; could be firewalls/routers/NATs in the way, other network ACLs that deny the connection, etc. | 
| Too many open files | EMFILE | Per-process limit of number of open files (including sockets) has been reached. | 
| Too many open files in system | ENFILE | System-wide limit of number of open files (including sockets) has been reached. |