ACZoom

The way to fix this is (of course) to use the native vsftpd.log, then the normal "FAIL LOGIN" entries will catch it.

I was wondering why this log file doesn't exist when using the default configuration that seems to come with RHEL/CentOS machines, all you get is /var/log/xferlog and the entries from pam in /var/log/secure, so I read the man page for vsftpd.conf!!

A quick way to fix this is to use the option "dual_log_enable=YES" which turns on the native vsftpd.log as well as the xferlog, then make sure your blockhosts config file says:

LOGFILES = [ "/var/log/secure", "/var/log/vsftpd.log", ]

Dave