Analyze transfer logs (xferlog) for proftpd
6 giugno 2008, 8:22 Debian , Open Source , Shell , System , Tips & Tricks June 6, 2008, 8:22
Proftpd track everything to the xferlog log file named.
In fact, many other FTP daemons write their log to a file with the same name and adopting the same format, so this tip can also affect those who use, for example, Wu-ftpd FTP or other standard BSD.
The xferlog file is usually located in one of the following directories:
/var/log
/var/log/proftpd/xferlog
/var/www/vhosts/{DOMAIN}/statistics/logs/xferlog_regular*
The last special case applies only to servers managed with Plesk.
The last character is provided in every row of the xferlog shows the way in which the transfer is completed. If the character is "c" means that the operation was completed successfully and if the character "i" means - to constrario - that the operation was not copmpletata and therefore the transfer was unsuccessful.
This command returns all transfers are incomplete:
egrep "i$" /path/to/xferlog
The three characters following the file name legend:
- transfer type (a = ascii b = binary)
- any particular action taken (usually shows the character "_" which is "no action")
- the transfer direction (o = outgoing, incoming = i, d = deleted)
To extract - for example - a list of all files uploaded successfully:
awk '($12 ~ /^i$/ && $NF ~ /^c$/){print $9}' /var/log/proftpd/xferlog
On the contrary, to extract a list of all files whose upload has failed:
awk '($12 ~ /^i$/ && $NF ~ /^i$/){print $9}' /var/log/proftpd/xferlog















October 11th, 2008 at 16:51
Sist of a web server. Centos OS and apache and php
There are log files that record
- The actions of the php socket that sends emails or data to other servers or clients?
- The action type fsckopen
- Mail sent from php
so you can monitor everything: ip, port etc to which the data are sent?
Or need special software?
October 13th, 2008 at 10:13
All the events you're talking about are properly logged by the system (obviously depends on the logging level you set on your server, such as in php.ini) but the thing I feel strongly raccomandarti is to manage this information in actively, loggando all in a specific file or table in your db. This fact allows you to have homogeneous log also when migrating to another platform and - most importantly - not having to go find the information you need pescandole by huge log files that contain large volumes of information, totally unnecessary (at least as With regard to your application).
Hope that was helpful
Hello! Ivan