anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
#anon_upload_enable=YES
dirmessage_enable=YES
xferlog_enable=YES
xferlog_file=/var/log/vsftpd.log
#xferlog_std_format=YES
#ascii_upload_enable=YES
#ascii_download_enable=YES
ftpd_banner=Welcome to MFOGTU FTP service.
#banned_email_file=/etc/vsftpd/banned_emails
#chroot_list_enable=YES
#chroot_list_file=/etc/vsftpd/chroot_list
#ls_recurse_enable=YES
listen=YES
#listen_ipv6=YES
pam_service_name=vsftpd
#userlist_enable=YES
tcp_wrappers=YES
chroot_local_user=YES

[root@host log]# cat /var/log/vsftpd.log 
Tue Sep 21 08:30:31 2010 [pid 16264] CONNECT: Client "192.168.1.122"
Tue Sep 21 08:30:31 2010 [pid 16263] [admin] OK LOGIN: Client "192.168.1.122"
Tue Sep 21 08:58:49 2010 [pid 16480] CONNECT: Client "192.168.1.122"
Tue Sep 21 08:58:50 2010 [pid 16479] [admin] OK LOGIN: Client "192.168.1.122"
Tue Sep 21 08:58:56 2010 [pid 16481] [admin] OK UPLOAD: Client "192.168.1.122", "/Port_IP_name.doc", 107520 bytes, 2159.74Kbyte/sec
Tue Sep 21 08:58:58 2010 [pid 16481] [admin] OK DELETE: Client "192.168.1.122", "/Port_IP_name.doc"

[Definition]
failregex = vsftpd(?:\(pam_unix\))?(?:\[\d+\])?:.* authentication failure; .* rhost=<HOST>(?:\s+user=\S*)?\s*$
            \[.+\] FAIL LOGIN: Client "<HOST>"\s*$
ignoreregex = 

# Do not ban anybody. Just report information about the remote host.
# A notification is sent at most every 600 seconds (bantime).
[vsftpd-notification]
enabled  = true
filter   = vsftpd
action   = sendmail-whois[name=VSFTPD, dest=root]
logpath  = /var/log/vsftpd.log
maxretry = 5
bantime  = 1800

# Same as above but with banning the IP address.
[vsftpd-iptables]
enabled  = false
filter   = vsftpd
action   = iptables[name=VSFTPD, port=ftp, protocol=tcp]
           sendmail-whois[name=VSFTPD, dest=root]
logpath  = /var/log/vsftpd.log
maxretry = 5
bantime  = 1800

[vsftpd-notification]

enabled  = true
filter   = vsftpd
action   = sendmail-whois[name=VSFTPD, dest=root]
logpath  = /var/log/vsftpd.log
maxretry = 3
bantime  = 1800

# Same as above but with banning the IP address.

[vsftpd-iptables]

enabled  = true
filter   = vsftpd
action   = iptables[name=VSFTPD, port=ftp, protocol=tcp]
           sendmail-whois[name=VSFTPD, dest=root]
logpath  = /var/log/secure
maxretry = 3
bantime  = 1800