6

I'm trying to analyze my FTP log to investigate some unauthorized access, but I can't make sense of some of the far right columns.

Thu Oct 01 00:13:55 2009 0 92.54.102.153 2547 /home/user1/public_html/index.html a _ o r user1 ftp 1 * c
Thu Oct 01 00:13:58 2009 0 77.252.189.148 2606 /home/user1/public_html/index.html a _ i r user1 ftp 1 * c

I can't find any documentation on how to read these logs.

2 Answers 2

7

Here is the website describing your log format. It has a good description of what every field in your log file means.

2
  • Awesome. I'm wondering if the proftpd and pureftpd log files are the same, or maybe I'm wrong about what's running on my server?
    – user22872
    Oct 15, 2009 at 14:21
  • Your link was really hard to spot at the start there. It was exactly what I was after though. Thanks. =)
    – Wireblue
    Nov 25, 2012 at 23:10
1

That log file format is called xferlog :

The default format of the xferlog for ProFTP contains the following information on each line:

current-time

  • Fri April 19 13:18:51 2024

transfer-time

  • whole seconds

remote-host file-size

  • size of transferred file in bytes

file-name transfer-type

  • a = ascii; b = binary

special-action-flag

  • C = compressed; U = uncompressed; T = tar'ed; _ = no action was taken

direction

  • o = outgoing; i = incoming; d = deleted

access-mode

  • a = anonymous; r = real

username service-name

  • usually ftp

authentication-method

  • 0 = none; 1 = RFC931 Authentication

authenticated-user-id

  • user id or '*'

completion-status

  • c = complete; i = incomplete

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .