1

Hello this is a mystery for me. We have an FTP server in our company and some accounts are sometimes locked because of repeated logins with bad password. I am trying to search in the ftp logfile (u_ex160330.log) but have no idea if it is logged there at all and how do I find it. Line containing the usernam and PASS command mean user is authenticating, but how do I see when it failed? There is no "error" or "fail" in that log. I thought that successful login means next line with the same username contains SYST command, but there are hundreds of users so lines from different usernames are all over themselves so I would have to make some crazy script logic to ho through it, but anyway I have no idea what to look for. Googling took me more time then writing this so I think it would be more effective to just ask ;-) Thank you

  • You should try checking the Windows security event log in eventwvr.exe, there maybe events in there, the ftp logs don't have any information about this. – Peter Hahndorf Mar 30 '16 at 15:36
  • but the windows eventlog / security only says that this account failed to log on because Unknown user name or bad password, but there is no information about client ip so that's useless. I was thinking I can use the time of the event and look for lines in the FTP log with that time, but no - it seems these times are not correlated. I found lines with this username in ftp log but about 5 seconds after the security event record! Is this normal? I will check more and if there is a correlation I will consider these lines 5seconds after the eventlogs... – Vitas Mar 31 '16 at 8:04
2
+25

I hope i understand your question correctly.

You can customize your FTP logging by selecting W3C Fields.

First of all make sure that you habe FTP Extensibility enabled either by searching it in your "Programmes & Features" or by simply running this command in elevated PowerShell:

get-windowsfeature Web-Ftp-Ext | select InstallState

if it doesn't return "Installed" use

get-windowsfeature Web-Ftp-Ext | Add-Windowsfeature

to install the feature.

Inside your IIS Manager, on your FTP-Site level, you should see an option called "FTP Logging". doubleclick that, then on "Log File Rollover" section click "select W3C Fields" and activate everything that you want to log (ip-adresses for example).

The logging information is stored in %SystemDrive%\inetpub\logs\LogFiles by default. if you changed your log path to somewhere else, you'll need to find your custom log path.

If this logging is not enough to collect the information you want to, I'd suggest collecting Traces for FTP Sessions. You'll need logman and logparser for this task. With that, you should be able to get your authentification error.

logman and logparser will tell you, when/where exactly the error occurs and give you the proper error code for this scenario.

detailed information on how to work with logman and logparser: http://blogs.iis.net/sudt/collecting-etw-traces-for-ftp-sessions

| improve this answer | |
  • Sorry we are super busy. Web-Ftp-Ext is installed. Client IP address is checked in FTP logging But as I clearly described these logs are useless because there is no information if the login attempt (PASS command) was a success or fail! Please elaborate more how to collect Traces for FTP Sessions. Not sure what that is... – Vitas Apr 20 '16 at 11:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.