View and analyze Linux ProFTPD logs

The company uses FTP to receive the customer's EDI order. Recently, the customer said that the order has been sent to us through FTP a long time ago. Why haven't it been delivered yet, but after repeated checks, the order was not found on FTP, but the customer insisted that the order had been uploaded. It seems that only the operation logs on FTP could be viewed to solve the dispute, and data could be used to speak.

The company's FTP is built based on the ProFTPd software in Linux. First, check the ProFTPd configuration file:

VI/etc/ProFTPd. conf

Find the path of the log file, as shown in red circles.

Truncate the log Content of an FTP account and save it to a new file: (in the following example, the account is ftpwbshop)

Cat xferlog. Processed | grep ftpwbshop>/home/ftpwbshop. Log

You can get the following logs for multiple lines:

Thu Dec 3 10:46:32 2009 0 120.32.171.4 2236/vhost/vhostroot/cycxm2/www/uploadfile/20090307132822145.jpg A _ d r cycxm2 FTP 0 * C
Each parameter of the record corresponds to the following:
Current-time transmission time Fri Jan 9 10:07:20 2004
Transfer-time transmission Duration: 0 s
Remote-host remote FTP client address 192.168.0.88
File-size Transfer File Size 320 B
File-name transfer file name/home/redflag/partitioninfo
Transfer-type transmission type B indicates binary transmission, and a indicates ASCII Transmission
Special-action-flag special behavior flag _, C indicates the compressed file, u indicates not compressed, t indicates to be tar, _ indicates no special behavior
Direction I: Upload, O: download, and D: Delete
Access-mode R indicates the System user, and a indicates the anonymous user.
Username username redflag
Service-Name: name of the FTP server software called
Authentication-method authentication method. 0 indicates no
Authen-ticated-user-ID * indicates that no user ID is authenticated.
Completion-status transmission completion status C indicates completion, And I indicates completion