Below is a cut and past from my log files that are sent to me. This is from the last day that proftpd worked correctly. I'm not sure why proftpd was restarted as the log states:
################### LogWatch 5.2.2 (06/23/04) #################### Processing Initiated: Sun Feb 19 09:02:02 2006 Date Range Processed: yesterday Detail Level of Output: 0 Logfiles for Host: ftp.csdsinc.com ################################################################
--------------------- ftpd-xferlog Begin ------------------------
TOTAL KB IN: 548KB (0MB)
Incoming Anonymous FTP Transfers: 64.151.114.234 -> /var/ftp/gps/cors/Mirror.txt (2 Times) 192.168.1.91 -> /var/ftp/gps/gis/B6021802.zip 192.168.1.91 -> /var/ftp/gps/gis/index.ndx (2 Times) 192.168.1.91 -> /var/ftp/gps/gis/B6021803.zip 64.151.114.234 -> /var/ftp/gps/cors/rinex/2006/049/sacr/Ephm0490.06n (2 Times) 64.151.114.234 -> /var/ftp/gps/cors/rinex/2006/048/sacr/sacr0480.06a (2 Times)
---------------------- ftpd-xferlog End -------------------------
--------------------- httpd Begin ------------------------
Connection attempts using mod_proxy: 207.44.162.13 -> 205.188.155.89:25 : 2 Time(s)
---------------------- httpd End -------------------------
--------------------- pam_unix Begin ------------------------
crond: Unknown Entries: session closed for user root: 458 Time(s) session opened for user root by (uid=0): 458 Time(s)
su: Sessions Opened: em(uid=500) -> root: 1 Time(s)
---------------------- pam_unix End -------------------------
--------------------- proftpd-messages Begin ------------------------
**Unmatched Entries** proftpd shutdown succeeded - warning: AuthPAMAuthoritative is deprecated proftpd startup succeeded
---------------------- proftpd-messages End -------------------------
--------------------- Connections (secure-log) Begin ------------------------
**Unmatched Entries** userhelper[25867]: pam_timestamp: updated timestamp file `/var/run/sudo/root/0' userhelper[25868]: running '/usr/lib64/chkrootkit-0.46a/chkrootkit.sh' with root privileges on behalf of 'root' userhelper[26875]: pam_timestamp: updated timestamp file `/var/run/sudo/root/0' userhelper[26876]: running '/usr/lib64/chkrootkit-0.46a/chkrootkit.sh' with root privileges on behalf of 'root'
---------------------- Connections (secure-log) End -------------------------
--------------------- sendmail Begin ------------------------
Bytes Transferred: 200978 Messages Sent: 2 Total recipients: 2 ---------------------- sendmail End -------------------------
--------------------- SSHD Begin ------------------------
Users logging in through sshd: xxxxxx: c-71-197-66-21.hsd1.ca.comcast.net (71.197.66.21): 1 time
---------------------- SSHD End -------------------------
------------------ Disk Space --------------------
/dev/md1 366G 28G 320G 9% / /dev/md0 99M 27M 67M 29% /boot
###################### LogWatch End #########################