I'm trying to use goaccess log analysis tool, to analyse vsftpd FTP server's logs. I'm aware that being a web server log analyser, goaccess is not the best tool for this. That being said, it's flexible enough with the log format and we're already using it to analyse the web server's log, so I decided to give it a try.
By default vsftpd has a very chatty log:
Mon Mar 23 06:00:00 2020 [pid 11111] CONNECT: Client "220.127.116.11" Mon Mar 23 06:00:00 2020 [pid 11111] [ftp] OK LOGIN: Client "18.104.22.168", anon password "blablabla" Mon Mar 23 06:00:00 2020 [pid 11111] [ftp] FAIL DOWNLOAD: Client "22.214.171.124", "/file1", 0.00Kbyte/sec Mon Mar 23 06:00:00 2020 [pid 11111] [ftp] OK DOWNLOAD: Client "126.96.36.199", "/file2", 17500 bytes, 203.15Kbyte/sec
As modern servers —usually— have single a line of log for a particular request, my first step was to change the logging to
xferlog format, which gives a single line per transfer.
# /etc/vsftpd.conf xferlog_enable=YES xferlog_std_format=YES xferlog_file=/var/log/vsftpd.log
Now I have log lines like the following.
Sat Mar 28 06:00:00 2020 1 188.8.131.52 17500 /file1 b _ o a anonymous ftp 0 * c Sat Mar 28 06:00:00 2020 1 184.108.40.206 0 /file2 b _ o a anonymous@host ftp 0 * i
As this is a download server only getting anonymous & passive FTP requests, I can assume the
anonymous@host are whatever the client provides for anonymous FTP.
How can I analyse this log with goaccess?