The Xferlog Logging System

If a file transfer log is enabled with the FtpXferlog configuration parameter, the nsftp module tracks uploads and downloads using the Xferlog format (the same one as wu-ftp) and records system commands. The man page for Xferlog is provided below:

XFERLOG(5)

NAME

xferlog - FTP server logfile

DESCRIPTION

The xferlog file contains logging information from the FTP server daemon, ftpd(8). This file usually is found in /usr/adm, but can be located anywhere by using a option to ftpd(8). Each server entry is composed of a single line of the following form, with all fields being separated by spaces.

    current-time transfer-time remote-host file-size filename transfer-type
special-action-flag direction access-mode username service-name
authentication-method authenticated-user-id

current-time is the current local time in the form "DDD MMM dd hh:mm:ss YYYY". Where DDD is the day of the week, MMM is the month, dd is the day of the month, hh is the hour, mm is the minutes, ss is the seconds, and YYYY is the year.

transfer-time is the total time in seconds for the transfer.

remote-host is the remote host name.

file-size is the size of the transfered file in bytes.

filename is the name of the transfered file.

transfer-type is a single character indicating the type of transfer. It can be one of:

a for an ascii transfer

b for a binary transfer

special-action-flag is one or more single character flags indicating any special action taken. Can be one or more of:

C file was compressed

U file was uncompressed

T file was tar'ed

_ no action was taken

direction is the direction of the transfer. Can be one of:

o outgoing

i incoming

access-mode is the method by which the user is logged in. Can be one of:

a (anonymous) is for an anonymous guest user

g (guest) is for an passworded guest user (see the guestgroup command in ftpaccess(5))

r (real) is for a local authenticated user

username is the local username, or if guest, the ID string

service-name is the name of the service being invoked, usually FTP

authentication-method is the method of authentication used. Can be one of:

0 none

1 RFC931 Authentication

authenticated-user-id is the user id returned by the authentication method. A * is used if an authenticated user id is not available.

FILES

/usr/adm/xferlog

SEE ALSO

ftpd(8), ftpaccess(5)