1

Hello this is a mystery for me. We have an FTP server in our company and some accounts are sometimes locked because of repeated logins with bad password. I am trying to search in the ftp logfile (u_ex160330.log) but have no idea if it is logged there at all and how do I find it. Line containing the usernam and PASS command mean user is authenticating, but how do I see when it failed? There is no "error" or "fail" in that log. I thought that successful login means next line with the same username contains SYST command, but there are hundreds of users so lines from different usernames are all over themselves so I would have to make some crazy script logic to ho through it, but anyway I have no idea what to look for. Googling took me more time then writing this so I think it would be more effective to just ask ;-) Thank you

Improve this question
2
  • You should try checking the Windows security event log in eventwvr.exe, there maybe events in there, the ftp logs don't have any information about this.
    – Peter Hahndorf
    Mar 30, 2016 at 15:36
  • but the windows eventlog / security only says that this account failed to log on because Unknown user name or bad password, but there is no information about client ip so that's useless. I was thinking I can use the time of the event and look for lines in the FTP log with that time, but no - it seems these times are not correlated. I found lines with this username in ftp log but about 5 seconds after the security event record! Is this normal? I will check more and if there is a correlation I will consider these lines 5seconds after the eventlogs...
    – Vitas
    Mar 31, 2016 at 8:04

1 Answer 1

Reset to default
2
+25

I hope i understand your question correctly.

You can customize your FTP logging by selecting W3C Fields.

First of all make sure that you habe FTP Extensibility enabled either by searching it in your "Programmes & Features" or by simply running this command in elevated PowerShell:

get-windowsfeature Web-Ftp-Ext | select InstallState

if it doesn't return "Installed" use

get-windowsfeature Web-Ftp-Ext | Add-Windowsfeature

to install the feature.

Inside your IIS Manager, on your FTP-Site level, you should see an option called "FTP Logging". doubleclick that, then on "Log File Rollover" section click "select W3C Fields" and activate everything that you want to log (ip-adresses for example).

The logging information is stored in %SystemDrive%\inetpub\logs\LogFiles by default. if you changed your log path to somewhere else, you'll need to find your custom log path.

If this logging is not enough to collect the information you want to, I'd suggest collecting Traces for FTP Sessions. You'll need logman and logparser for this task. With that, you should be able to get your authentification error.

logman and logparser will tell you, when/where exactly the error occurs and give you the proper error code for this scenario.

detailed information on how to work with logman and logparser: http://blogs.iis.net/sudt/collecting-etw-traces-for-ftp-sessions

Improve this answer
1
  • Sorry we are super busy. Web-Ftp-Ext is installed. Client IP address is checked in FTP logging But as I clearly described these logs are useless because there is no information if the login attempt (PASS command) was a success or fail! Please elaborate more how to collect Traces for FTP Sessions. Not sure what that is...
    – Vitas
    Apr 20, 2016 at 11:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .