NcFTPd: Session Log Format

NcFTPd Session Log Format

Note that depending on your version of NcFTPd, your logs may have fewer fields than those listed here; newer versions will try to maintain backwards compatibility by appending new fields (rather than inserting new fields, deleting old fields, or otherwise modifying the line format).

1996-08-26 00:22:11 #u2 | anonymous,mozilla@my.host.com,actual.host.com,128,3.6,342231,441668,35,3,2,3,3,0,4,8,1,3,3,0,1,0,OK,3,0,2,0,3,0,RMf0YAABAAEA,

Prefix 1: Date and time: When the remote client was logged out and disconnected.

Prefix 2: Child number: The name of the child process that served the client connection.

Field 1: User: Username attempted to login as, or anonymous for anonymous FTP users. Note that this field does not imply that user was successfully logged in. There are two special values here: REFUSED and DENIED. The latter refers to remote clients who were refused a connection (or disconnected immediately) because the server was at its max user limit; the former refers to users disconnected immediately because the client address was rejected by TCP Wrappers.

Field 2: Email: Email address as entered by the anonymous FTP user at the password prompt. Will be blank for non-anonymous users.

Field 3: Host: IP or hostname of the remote host the client is originating from.

Field 4: Session time: Total number of seconds user was logged in to the server.

Field 5: Time between commands: Average number of seconds between FTP commands.

Field 6: Bytes retrieved: Total bytes downloaded.

Field 7: Bytes Stored: Total bytes uploaded.

Field 8: Number of commands: Total number of commands the remote FTP client issued.

Field 9: Retrieves: Total number of retrieves (downloads) attempted.

Field 10: Stores: Total number of stores (uploads) attempted.

Field 11: Chdirs: Number of directory changes attempted.

Field 12: NLSTs: Number of directory listings (short mode).

Field 13: LISTs: Number of directory listings (detailed mode).

Field 14: Types: Number of transfer type changes.

Field 15: PORT/PASV: Number of data connection address specifications.

Field 16: PWD: Number of print working directory requests.

Field 17: SIZE: Number of file size requests.

Field 18: MDTM: Number of file modification time requests.

Field 19: SITE: Number of site commands.

Field 20: Logins: Number of successful logins.

Field 21: Failed Data Connections: Number of data connections that could not be established due to some sort of an error (i.e. timed-out during connect to address client specified using PORT).

Field 22: Last transfer result: The status code of the session's last data transfer, or NONE if no transfers were attempted.

Field 23: Successful downloads: Number of successful downloads.

Field 24: Failed downloads: Number of failed downloads.

Field 25: Successful uploads: Number of successful uploads.

Field 26: Failed uploads: Number of failed uploads.

Field 27: Successful listings: Number of successful directory listings.

Field 28: Failed listings: Number of failed directory listings.

Field 29: Close Code: Reason the client was disconnected (see below).

Field 30: Session ID: Unique session identifier. This can be used to match the session with entries in the transfer logs.

Field 31: Domain: Specifies which of your server's domains (set-name) the remote user connected to.

Field 29 Close Codes

Value	Meaning
0	Normal disconnect (client issued `QUIT` primitive).
1	End-of-file on control connection; the client closed the connection but did not issue a `QUIT` primitive. This should not be considered an error in most cases.
2	Miscellaneous error.
3	Client exceeded idle timeout limit.
4	Client exceeded login timeout.
5	Timed-out while sending to client.
6	Lost connection (`broken pipe`).
7	Control `connection reset by peer`.
8	Network I/O error (error reported by `read` or `write` system call).
9	TCP Wrappers denied the user.
10	Too many users already logged on.
11	Too many users already logged on to domain.
12	Too many users already logged on by the same username.
13	Too many users already logged on by the same IP address.
14	Bad startup directory.
15	Passive data socket failed.
16	Passive data connection accept timed-out.
17	Passive data connection accept failed.
18	Passive data connection accept succeeded, but remote port was under 1024.
19	Passive data connection accept succeeded, but remote address was different from that of the control connection and proxy connections are disabled.
20	Port data connection attempt to client timed-out.
21	Port data connection attempt to client failed.
22	Port data connection specified a different remote address than that of the control connection and proxy connections are disabled.
23	Port data connection specified an internal network address.
24	Port data connection specified a remote port number under 1024.
25	Control connection's port number was under 1024.
26	Socket failed.
27	`ncftpd_authd` exchange state failed.
28	`ncftpd_authd` denied the user.
29	`ncftpd_authd` miscellaneous error.
30	Too many failed username/password attempts.
31	No logins are allowed during system maintenance (`/etc/nologin` file exists).
32	Anonymous logins not allowed here.
33	Non-anonymous logins not allowed here.
34	Buffer overflow attempted by client.
35	Could not restore user privileges.
36	Domain is marked as `disabled`.
37	Timed out during data transfer.
38	Wrong protocol (such as HTTP or SMTP) used by client.
39	Syntax error in passwd database user record.
40	Malformed User Permssions String in passwd database user record or from Authd.
41	Malformed Umask in passwd database user record or from Authd.