Skip to main content

Monitoring Pure-FTPd

Pure-FTPd is recognised by its process, in both the plain and the MySQL-backed build, and monitored through the journal it logs to plus pure-ftpwho for live sessions. Nothing is configured on your side, and the port check follows whatever port the daemon actually listens on.

How Pure-FTPd is recognised​

Two signed definitions cover the two binaries, pure-ftpd and pure-ftpd-mysql; both report under the same service name with the same metrics, so rules do not care which one runs. Every 60 seconds the agent dials the TCP port owned by the daemon process (taken from the listening sockets it discovered, so a non-standard port works without telling anyone), runs the binary with --help to read the version out of its banner, runs pure-ftpwho -n -s for the session list, and counts the journal entries of the pure-ftpd and pure-ftpd-mysql identifiers since its last pass.

What is collected​

Sessions. Each line of pure-ftpwho -n -s is one connected session; the agent counts them. -n skips reverse DNS so the count does not stall on a slow resolver.

Logins and transfers. Four counters over the journal: logged in lines at [INFO] become the login rate, Authentication failed at [WARNING] the failed-login rate, uploaded and downloaded at [NOTICE] the transfer rates, all per second.

Liveness. A connection to the discovered port has to be accepted. If the process owns no listening port, the check says so instead of dialling a guess.

Facts shown on the host page: version.

SignalMetric
Live sessionssvc.pure-ftpd.sessions
Logins per secondsvc.pure-ftpd.login_rate
Failed logins per secondsvc.pure-ftpd.login_fail_rate
Uploads / downloads per secondsvc.pure-ftpd.upload_rate, svc.pure-ftpd.download_rate

Names, tags and units are in the metrics reference.

Logs. The journal entries of both identifiers ship at notice level and above: authentication failures (WARNING) and transfers (NOTICE) are in, the INFO login lines are not unless you switch the service to full depth in the console. See Logs.

Alerts out of the box​

RuleFires whenSeverityShips
FTP brute-force in progress0.2 or more failed logins per second, sustained for two minuteswarningauto

Twelve failures a minute for two minutes is a dictionary run, not a forgotten password. auto means the rule arms itself the moment svc.pure-ftpd.login_fail_rate starts flowing for your workspace; a host without FTP never carries it. The incident closes once failures fall under 0.05 per second. vsftpd has the same rule with the same numbers. Thresholds and hysteresis are in the rules catalog.

Limitations​

  • Rates come from the systemd journal. On a host without journald, or where Pure-FTPd runs with syslog logging turned off, the rates stay empty; sessions and the port check still work.
  • Only the pure-ftpd and pure-ftpd-mysql binaries are matched. The LDAP and PostgreSQL builds are not recognised.
  • There is no per-source breakdown of failed logins; the shipped Authentication failed lines carry the client address.
  • Bytes transferred and per-user bandwidth are not collected.
  • There is no path override for Pure-FTPd, because nothing is read from a file: everything comes from the journal and the daemon's own commands.