1XFERLOG(5) File Formats Manual XFERLOG(5)
2
6 xferlog - ProFTPD server logfile
7
9 The xferlog file contains logging information from the FTP server dae‐
10 mon, proftpd(8). This file usually is found in /var/log but can be
11 located anywhere by using a proftpd(8) configuration directive. Each
12 server entry is composed of a single line of the following form, with
13 all fields being separated by spaces.
14 current-time transfer-time remote-host file-size file‐
16 name transfer-type special-action-flag direction access-
17 mode username service-name authentication-method authen‐
18 ticated-user-id completion-status
19 current-time is the current local time in the form "DDD MMM dd
21 hh:mm:ss YYYY". Where DDD is the day of the week,
22 MMM is the month, dd is the day of the month, hh is
23 the hour, mm is the minutes, ss is the seconds, and
24 YYYY is the year.
25 transfer-time is the total time in seconds for the transfer.
27 remote-host is the remote host name.
29 file-size is the size of the transferred file in bytes.
31 filename is the name of the transferred file. If the file‐
33 name contains any spaces or control characters,
34 each such character is replaced by an underscore
35 ('_') character.
36 transfer-type is a single character indicating the type of trans‐
38 fer. Can be one of:
39 a for an ascii transfer
40 b for a binary transfer
41 special-action-flag is one or more single character flags indicating
43 any special action taken. Can be one or more of:
44 C file was compressed
45 U file was uncompressed
46 T file was tar'ed
47 _ no action was taken
48 direction is the direction of the transfer. Can be one of:
50 o outgoing
51 i incoming
52 d deleted
53 access-mode is the method by which the user is logged in. Can
55 be one of:
56 a (anonymous) is for an anonymous
57 guest user.
58 r (real) is for a local authenti‐
59 cated user.
60 username is the local username, or if guest, the ID string
62 given.
63 service-name is the name of the service being invoked, usually
65 FTP.
66 authentication-method
68 is the method of authentication used. Can be one
69 of:
70 0 none
71 1 RFC931 Authentication
72 authenticated-user-id
74 is the user id returned by the authentication
75 method. A * is used if an authenticated user id is
76 not available.
77 completion-status is a single character indicating the status of the
79 transfer. Can be one of:
80 c complete transfer
81 i incomplete transfer
82
84 /var/log/xferlog
86 ProFTPD is written and maintained by a number of people, full credits
87 can be found on http://www.proftpd.org/credits.html
88
90 proftpd(8)
91 Full documentation on ProFTPD, including configuration and FAQs, is
93 available at http://www.proftpd.org/
94 For help/support, try the ProFTPD mailing lists, detailed on
96 http://www.proftpd.org/lists.html
97 Report bugs at http://bugs.proftpd.org/
99 XFERLOG(5)