Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My index.php files has suddenly been deleted today. I downloaded the FTP log file from the server. I see that an unknown user has accessed my FTP server today. I have the following line in my FTP log, but don't know how to read it:

Fri Dec 31 13:25:51 2010 0 ::ffff:[IP HERE] 10079 [FILE NAME] a _ o r [USERNAME] ftp 0 * c

What do the following pieces of information mean? 10079 and a_ o r and 0 * c ?

share|improve this question
up vote 5 down vote accepted

FTP logs are largely in xferlog format. That follows this convention:

current-time   transfer-time   remote-host   file-size   filename   transfer-type   special-action-flag   direction   access-mode   username   service-name   authentication-method   authenticated-user-id  completion-status

In your case, I believe you are interpreting 10079, a_or and O*c as three separate pieces of information. Those pieces of information are actually seven distinct pieces of information

  • 10079 is the file size
  • a is transfer type (a stands for an ascii transfer)
  • _ is the special-action-flag (_ means no action taken)
  • o is the direction (o is for outgoing)
  • r is for access mode (r is for "real" or locally authenticated user)
  • 0 is for authentication-method (0 = none)
  • * is for authenticated-user-id (* means "not available")
  • c is for completion-status (c means "complete" for a complete transfer)

Check out man xferlog for more information. Here's a web based man page for xferlog.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.