NcFTPd Stat Log Format

Note that depending on your version of NcFTPd, your logs may have fewer fields than those listed here; newer versions will try to maintain backwards compatibility by appending new fields (rather than inserting new fields, deleting old fields, or otherwise modifying the line format).

The stat logs contain lines of counters, and look like a long stream of comma-delimited numbers.  Here's an example:


2002-02-06 20:00:00,1013047200,2002-02-06 20:14:59,1013048099,925,0,0,925,0,14712,2136,824,247,0,925,0,0,0,0,0,0,0,5,0,0,0,73,0,0,0,0,1239,485,0,0,478,0,276,0,0,578059,0,0,0,2972.59,0,0,0,0,0,0,0,0,0,0,0,0,0,0.00,22



Log entries contain one line per interval (15 minute period).  The first four fields are the starting and ending times of the interval.

Field 1: Starting Date (human readable; YYYY-MM-DD HH:MM:SS).

Field 2: Starting Date (timestamp; seconds since 1970-01-01 00:00:00).

Field 3: Ending Date (human readable; YYYY-MM-DD HH:MM:SS).

Field 4: Ending Date (timestamp; seconds since 1970-01-01 00:00:00).



The next five fields are counters for the number of logins.

Field 5: Total number of connections received.

Field 6: Number of connections refused.  These connections were immediately closed by the server because the server is full, or is not accepting connections of the particular user class (i.e., too many users from the same IP address were already logged on).

Field 7: Total number of logins denied.  These were connections that were accepted, but the user's login was rejected.  Reasons for these include: 
Field 8: Total number of connections with a succesful login.

Field 9: Total number of connections with an unsuccessful login.  This is Field 5 - Field 8.



The next five fields deal with what types of activity took place during the login.

Field 10: Total number of seconds spent servicing remote clients.  The average duration of successful login sessions can be computed by dividing this field by Field 8.

Field 11: Total number of directory listings performed.

Field 12: Total number of logins that requested at least one directory listing.

Field 13: Total number of logins with at least one successful download.

Field 14: Total number of logins with at least one successful upload.



The next 8 fields count which type of client program was being used by the remote user.  Since FTP has no equivalent of HTTP's "User-Agent" field, this data is obtained using heuristics and is not very accurate.  The primary way this is determined is by analyzing the password sent by a user logging in anonymously; for example, the Netscape web browser uses "mozilla@" as this password.

Field 15:  Total number of successful logins using NcFTP Client.

Field 16:  Total number of successful logins using Netscape web browsers.

Field 17:  Total number of successful logins using Microsoft Internet Explorer.

Field 18:  Reserved for future use.

Field 19:  Reserved for future use.

Field 20:  Reserved for future use.

Field 21:  Reserved for future use.

Field 22:  Reserved for future use.



The next six fields measure the type of bandwidth available to the remote client.  This is done by calculating the total throughput of the session, so this is an estimate.

Field 23:  Total number of successful logins with at least one file transfer whose bandwidth is 33.6 kBps or less.

Field 24:  Total number of successful logins with at least one file transfer whose bandwidth is between 33.6 and 56 kBps.

Field 25:  Total number of successful logins with at least one file transfer whose bandwidth is between 56 and 256 kBps.

Field 26:  Total number of successful logins with at least one file transfer whose bandwidth is between 256 kBps and 10 MBps.

Field 27:  Total number of successful logins with at least one file transfer whose bandwidth is between 10 and 100 MBps.

Field 28:  Total number of successful logins with at least one file transfer whose bandwidth is greater than 100 MBps.



The next three fields are reserved for future use.

Field 29:  Reserved for future use.

Field 30:  Reserved for future use.

Field 31:  Reserved for future use.



The next group of fields measure the statistics about downloaded files (files sent from the FTP server machine to the remote client machine).

Field 32:  Total number of downloads attempted.

Field 33:  Total number of successful downloads (result code was OK).

Field 34:  Total number of downloads with a result of ABOR (aborted download; see the xfer log documentation for details on these result codes.)

Field 35:  Total number of downloads with a result of ERROR (miscellaneous error).

Field 36:  Total number of downloads with a result of INCOMPLETE (transfer did not finish).

Field 37:  Total number of downloads with a result of NOENT (file did not exist).

Field 38:  Total number of downloads with a result of PERM (permission denied).

Field 39:  Reserved for future use.

Field 40:  Reserved for future use.

Field 41:  Total number of kilobytes downloaded.

Field 42:  Reserved for future use.

Field 43:  Reserved for future use.

Field 44:  Reserved for future use.

Field 45:  Total number of seconds spent downloading.



The next group of fields measure the statistics about uploaded files (files sent from the remote client machine to the FTP server machine).

Field 46:  Total number of uploads attempted.

Field 47:  Total number of successful uploads (result code was OK).

Field 48:  Total number of uploads with a result of ABOR (aborted upload)

Field 49:  Total number of uploads with a result of ERROR (miscellaneous error).

Field 50:  Total number of uploads with a result of INCOMPLETE (transfer did not finish).

Field 51:  Total number of uploads with a result of NOENT (file did not exist; should always be 0).

Field 52:  Total number of uploads with a result of PERM (permission denied).

Field 53:  Reserved for future use.

Field 54:  Reserved for future use.

Field 55:  Total number of kilobytes uploaded.

Field 56:  Reserved for future use.

Field 57:  Reserved for future use.

Field 58:  Reserved for future use.

Field 59:  Total number of seconds spent uploading.



The last field (as of this writing) is...

Field 60:  Maximum number of simultaneous users that were logged in during the interval.  This field is very useful for determining an optimal setting of max-users.  If your server is frequently at or near the maximum, you may want to increase max-users if you can.


See AlsoTransfer Log Format : Session Log Format

Up
NcFTPd Home