NcFTPd Transfer Log Format

"Transfer Log" (xfer log) is a misnomer; the log is actually closer to a transaction log which logs not only uploads and downloads, but also other operations such as deletes, directory listings, and renames.  Note that depending on your version of NcFTPd, your logs may have fewer fields than those listed here; newer versions will try to maintain backwards compatibility by appending new fields (rather than inserting new fields, deleting old fields, or otherwise modifying the line format).


1996-08-26 00:22:11 #u2 | R,/home/ftp/pub/big.file,4627440,23.223,194.591,anonymous,mozilla@my.host.com,actual.host.com,.tar.gz,OK,I,PsSf,841036734,RMf0YAABAAEA,4637440,10000,

Prefix 1: Date and time: Time when the transfer operation finished.

Prefix 2: Child number: The name of the child process that served the client connection.

Field 1: Type of log entry. Note that prior to version 2.2.2 of NcFTPd the only log entry types were S and R.

Value Meaning
R Retrieve operation (download from server)
S Store operation (upload to server)
T Directory listing operation
D Delete operation (file or empty directory removed successfully)
M Mkdir operation (directory creation) succeeded
C Chmod operation succeeded
L Symbolic link operation succeeded.
N Rename operation succeeded


This section only applies to the S and R log entry types.

Field 2: Pathname: Name of the file on the server.

Field 3: Size: How many bytes were transferred. This is not necessarily the size of the file on the client side, and the size may be smaller than expected if the transfer does not complete.

Field 4: Duration: Elapsed time in seconds.

Field 5: Rate: Transfer throughput rate, in kilobytes per second.

Field 6: User: Username logged in under, or anonymous for anonymous FTP users.

Field 7: Email: Email address as entered by the anonymous FTP user at the password prompt. Will be blank for non-anonymous users.

Field 8: Host: IP or hostname of the remote host the client is originating from.

Field 9: Suffix: If an "on-the-fly" translation method was used, this was the suffix requested.

Value Meaning
.tar Directory retrieved as a TAR file.
.tar.Z Directory retrieved as a compressed TAR file.
.tar.gz Directory retrieved as gzipped TAR file.
(blank) Nothing special was used.


Field 10: Completion: File transfer completion status:
Value Meaning
OK File was completely transferred successfully.
ABOR File was aborted by the remote client or forcefuly closed by the client (broken pipe, but the control connection was still active).
INCOMPLETE Data transfer connection to remote client was lost, such as network I/O timing out.  This could also be a result of a forcefully closed connection by the client (broken pipe) if the control connection was also forcefully closed.
PERM The client did not have sufficient access privileges to transfer the file ("permission denied").
NOENT The client program requested a file that did not exist.
ERROR Miscellaneous I/O error.

Field 11: Transfer Type: How the file was transferred:

Value Meaning
A File was transferred as ASCII text.
I File was transferred in binary (image).

 

Field 12: Transfer notes: Additional information on how the transfer was implemented.  Zero or more flags below may be indicated; when more than one flag is indicated, they will be appended to each other in no particular order, such as "MmBl". (Note: Df, Po, Ps require version 2.7.4 or later.)

Value Meaning
Df FTP default data connection (non-passive out to port 20) was used (rare).
Po PORT (non-passive) data connection was used.
Ps PASV (passive) data connection was used.
Mm Memory mapped I/O was used.
Bl Block transfer mode was used (very rare; obselete).
Sf Sendfile optimization was used.

Field 13:  Start of transfer: The timestamp when the transfer really started.  Due to how transfers are logged, it is not necessarily true that the start time is the time of the log entry minus the elapsed time.  The timestamp is the "tv_sec" field of a struct timeval; this field is usually a standard UNIX timestamp (number of seconds since Jan 1, 1970).

Field 14: Session ID: Unique session identifier generated for the user's FTP session. You can use this field to match session log information with transfer logs.

Field 15: Starting size: Size of the file in bytes when the transfer started. May be -1 if the size information was not available.

Field 16: Starting offset: The position in the file in bytes when the transfer started. This will be 0 for most transfers, and greater than zero if an FTP REST (restart) command was used (common when resuming transfers). May be -1 if the offset information was not available.


This section only applies to the T (directory listing) log entry type.

Field 2: Pathname: Absolute pathname of the directory (or filename) on the server that was listed.

Field 3: Completion: Listing completion status.  The status codes correspond to that of upload and downloads.

Field 4: Pattern: If the user requested a wildcard expression to filter the listing this field will contain the expression, otherwise it will be empty.

Field 5: Recursion: If the user requested a recursive directory traversal, this field will contain "RECURSIVE", otherwise it will be empty.

Field 6: User: Username logged in under, or anonymous for anonymous FTP users.

Field 7: Email: Email address as entered by the anonymous FTP user at the password prompt. Will be blank for non-anonymous users.

Field 8: Host: IP or hostname of the remote host the client is originating from.

Field 9: Session ID: Unique session identifier generated for the user's FTP session. You can use this field to match session log information with transfer logs.


This section only applies to the D (deletion) log entry type.

Field 2: Pathname: Absolute pathname of the file (or empty directory) on the server that was deleted.

Fields 3, 4, 5: Reserved: (Empty)

Field 6: User: Username logged in under, or anonymous for anonymous FTP users.

Field 7: Email: Email address as entered by the anonymous FTP user at the password prompt. Will be blank for non-anonymous users.

Field 8: Host: IP or hostname of the remote host the client is originating from.

Field 9: Session ID: Unique session identifier generated for the user's FTP session. You can use this field to match session log information with transfer logs.


This section only applies to the M (mkdir) log entry type.

Field 2: Pathname: Absolute pathname of the new directory on the server that was created.

Fields 3, 4, 5: Reserved: (Empty)

Field 6: User: Username logged in under, or anonymous for anonymous FTP users.

Field 7: Email: Email address as entered by the anonymous FTP user at the password prompt. Will be blank for non-anonymous users.

Field 8: Host: IP or hostname of the remote host

Field 9: Session ID: Unique session identifier generated for the user's FTP session. You can use this field to match session log information with transfer logs. the client is originating from.


This section only applies to the C (chmod) log entry type.

Field 2: Pathname: Absolute pathname of the file or directory on the server that was changed.

Field 3: Mode: Mode (in octal).

Fields 4, 5: Reserved: (Empty)

Field 6: User: Username logged in under, or anonymous for anonymous FTP users.

Field 7: Email: Email address as entered by the anonymous FTP user at the password prompt. Will be blank for non-anonymous users.

Field 8: Host: IP or hostname of the remote host

Field 9: Session ID: Unique session identifier generated for the user's FTP session. You can use this field to match session log information with transfer logs. the client is originating from.


This section only applies to the L (symlink) log entry type.

Field 2: Pathname: Absolute pathname of the existing file or directory on the server that was linked from.

Field 3: Reserved: (Contains the text "to")

Field 4: Pathname: Absolute pathname on the server that it was linked to.

Field 5: Reserved: (Empty)

Field 6: User: Username logged in under, or anonymous for anonymous FTP users.

Field 7: Email: Email address as entered by the anonymous FTP user at the password prompt. Will be blank for non-anonymous users.

Field 8: Host: IP or hostname of the remote host

Field 9: Session ID: Unique session identifier generated for the user's FTP session. You can use this field to match session log information with transfer logs. the client is originating from.


This section only applies to the N (rename) log entry type.

Field 2: Pathname: Absolute pathname of the existing file or directory on the server that was renamed from.

Field 3: Reserved: (Contains the text "to")

Field 4: Pathname: Absolute pathname on the server that it was renamed to.

Field 5: Reserved: (Empty)

Field 6: User: Username logged in under, or anonymous for anonymous FTP users.

Field 7: Email: Email address as entered by the anonymous FTP user at the password prompt. Will be blank for non-anonymous users.

Field 8: Host: IP or hostname of the remote host the client is originating from.

Field 9: Session ID: Unique session identifier generated for the user's FTP session. You can use this field to match session log information with transfer logs.


See AlsoSession Log Format : Stat Log Format

Up
NcFTPd Home