skip to content

System: xferlog - ProFTPD server logfile

 Tweet Share0 Tweets

The xferlog Format

The default format of the xferlog for ProFTP contains the following information on each line:

current-time
Wed September 20 20:58:59 2017
transfer-time
whole seconds
remote-host
file-size
size of transferred file in bytes
file-name
transfer-type
a = ascii; b = binary
special-action-flag
C = compressed; U = uncompressed; T = tar'ed; _ = no action was taken
direction
o = outgoing; i = incoming; d = deleted
access-mode
a = anonymous; r = real
username
service-name
usually ftp
authentication-method
0 = none; 1 = RFC931 Authentication
authenticated-user-id
user id or '*'
completion-status
c = complete; i = incomplete

Analysing the xferlog

When analysing the xferlog file, the first thing to look at is the completion-status - the last character in each row. This should always be c (complete) and not i (incomplete) as that indicates a problem with the transfer. This command will return all incomplete transfers:

egrep "i$" xferlog

Note: The xferlog file is normall located at /var/log/xferlog

Then look at the three characters following the file name. They represent the transfer-type (ascii or binary), any special actions (usually _ meaning none) and the direction (outgoing, incoming or deleted). Typical examples are:

Now, to extract a list of all successfully uploaded files:

awk '($12 ~ /^i$/ && $NF ~ /^c$/){print $9}' xferlog

and uploads that were unsuccessful:

awk '($12 ~ /^i$/ && $NF ~ /^i$/){print $9}' xferlog

References

< System

Send a message to The Art of Web:


used only for us to reply, and to display your gravatar.

<- copy the digits from the image into this box

press <Esc> or click outside this box to close

Post your comment or question
top