Does anyone know why my logs have so many entries for ftp sessions being opened by the localhost ip address? For instance:

Jul 20 04:30:01 www proftpd[17720]: www.my-domain.com (localhost[127.0.0.1]) - FTP session opened.
Jul 20 04:30:01 www proftpd[17720]: www.my-domain.com (localhost[127.0.0.1]) - FTP session closed.

IMHO it's the RaQ's active monitor to check if ftpd is running; according to swatch configuration in /etc/cobalt/swatch/services/ftp it makes a real connection to the ftpd instead of checking if the ftpd is running....

IMHO it's the RaQ's active monitor to check if ftpd is running; according to swatch configuration in /etc/cobalt/swatch/services/ftp it makes a real connection to the ftpd instead of checking if the ftpd is running....
Cool. I wonder why it has to do it so much. It seems like it's not real sure of itself or something.

swatch is run by cronjob every 15mins, and on failure of services specified in /etc/cobalt/swatch it will send an email to admin

you can edit the time of checks by editing /etc/crontab or even disable checking of specific services (ie. I disabled imapd totally so I got warnings all the time, so I had to disable swatch checking of imapd aswell)