For an ISMS audit finding we had to keep xferlog for one year. Here is what we applied.
I assumed /etc/vsftpd/vsftpd.conf would control it, but it did not. Edit /etc/logrotate.d/vsftpd and add monthly plus rotate 12 so logs under /var/log/xferlog/ accumulate for a year.

- yearly: once a year
- monthly: once a month
- weekly: once a week
- daily: once a day



Leave a Reply