Hi,

We have an FTP server (vsftpd) running on Linux, that I've kinda built a "Data Management" system around. I could use some ideas as to the best way to handle/create "triggers" for file notifications.

Internal users drag 'n drop files from their Windows boxes to the server via Samba mounts. FTP users transfer files via FTP (go figure). Programs run every five minutes to check for new files. Internal files are checked by first checking the filesystem size for changes, if so, then using the find command on the FTP directory and comparing it to the previous run. On the FTP side the program checks the log file for newly transferred files.
From the difference between the two it generates an email to the proper internal & external people telling them that there are files and what the names are. Also CCing FTPadmin group, then updates a database with all the info.

Ok now that you know how the files are transferred. My questions are as follows;

1) Internal Transfers. Is there a better way to find new files than using the find and comparing the differences? We've hit the 400 user mark and at peek times running find and parsing the output can be a bit slow.

2) FTP Transfers. What's the best way to determine when an FTP transaction is complete. Keep in mind that I'll have to track multiple connections starting and ending at different times.

As to question #2, I've written a simple packet sniffer in C which does nothing more than let me know when an FTP connection has been established and from what IP, then lets me know when that connection has terminated so another program can generate notifications. The problem with this is; FTP users are using arbitrary "Keep Alives" making it virtually impossible to determine inactivity to be able to disconnect the user. To add to the complexity, the FTP server is using SSL encryption so dumping the packets to determine their contents and file progress is useless. Also, I could have vsftpd log ALL FTP events to the log file but the increase would more than triple the log file size again slowing things down to a crawl.

Thank You in Advance