Reading FTP Logs

The following article assumes that you have already been provided FTP logs for your site to review. If you wish to obtain a copy of the FTP logs for your site for a specific time period, please contact Tech Support. Tech Support may be reached 24 hours a day via one of the methods in the Knowledge Base article located here.
 
 
Anytime a connection is made to a site via File Transfer Protocol (FTP), log entries are created on the web server specifying details about each connection. Below you will find an example of a FTP log excerpt and brief explanation of each part of the excerpt: 
 
 
  • Fri May 14 05:16:12 2010 0 ::ffff:1.2.3.4 11974 /home/user/public_html/index.php a _ i r user ftp 0 * c
 
- Fri May 14 05:16:12 2010          [Date/time stamp.]
 
- 0                                                [Transfer time, in whole seconds (this transfer took less than a second, so zero).]
 
- ::ffff:1.2.3.4                                [Remote host where the user connected from.]
 
- 11974                                        [Size of the transferred file (in bytes).]
 
- /home/user/public_html/index.php    [Full path to the uploaded file.]
 
- a                                               [Transfer type, a = ASCII (plain-text files), b = binary (everything else)]
 
- _                                               [Action flag, C = compressed, U = uncompressed; T = tar'ed; _ = no action.]
 
- i                                                [Direction, i = incoming, o = outgoing, d = deleted.]
 
- r                                                [Access mode, a = anonymous user, r = real (normal) user.]
 
- user                                          [Local username authenticated with.]
 
- ftp                                             [The service being invoked (almost always FTP).]
 
- 0                                                [Authentication method, 0 = none, 1 = RFC931 authentication.]
 
- *                                                [User ID or * if not available (virtual user).]
 
- c                                                [Completion status, c = completed, i = incomplete.]

Add Feedback