NcFTPd Stat Log Format
Note that depending on your version of NcFTPd, your logs may
have
fewer fields than those listed here; newer versions will try to
maintain
backwards compatibility by appending new fields (rather than inserting
new
fields, deleting old fields, or otherwise modifying the line format).
The stat logs contain lines of counters, and look like a long stream
of comma-delimited numbers. Here's an example:
2002-02-06
20:00:00,1013047200,2002-02-06
20:14:59,1013048099,925,0,0,925,0,14712,2136,824,247,0,925,0,0,0,0,0,0,0,5,0,0,0,73,0,0,0,0,1239,485,0,0,478,0,276,0,0,578059,0,0,0,2972.59,0,0,0,0,0,0,0,0,0,0,0,0,0,0.00,22
Log entries contain one line per interval (15 minute period). The
first four fields are
the starting and ending times of the interval.
Field 1:
Starting Date (human
readable; YYYY-MM-DD HH:MM:SS).
Field 2: Starting Date
(timestamp; seconds since 1970-01-01 00:00:00).
Field 3: Ending Date (human
readable; YYYY-MM-DD HH:MM:SS).
Field 4: Ending Date
(timestamp; seconds since 1970-01-01 00:00:00).
The next five fields are counters for the number of
logins.
Field 5:
Total number of
connections received.
Field 6: Number of connections
refused. These connections
were immediately closed by the server because the server is full, or is
not accepting connections of the particular user class (i.e., too many
users from the same IP address were already logged on).
Field 7: Total number of logins
denied. These were
connections that were accepted, but the user's login was
rejected. Reasons for these include:
- Too many incorrect user/password attempts
- Tried to login anonymously to a domain that does not accept
anonymous users
- Tried to login with a username/password to a domain that only
accepts anonymous users
- Login denied by TCP Wrappers
- Login denied by Authd
- Server is not allowing logins during system maintenance (/etc/nologin or /etc/nologin.ftp file present)
- Control connection had remote port < 1024
Field 8:
Total number of
connections with a succesful login.
Field 9: Total number of
connections with an unsuccessful login. This is Field 5 - Field 8.
The next five fields deal with what types of
activity took
place during the login.
Field
10: Total number of
seconds spent servicing remote clients. The average duration of
successful login sessions can be computed by dividing this field by Field 8.
Field 11: Total number of
directory listings performed.
Field 12: Total number of
logins that requested at least one directory listing.
Field 13: Total number of
logins with at least one successful download.
Field 14: Total number of
logins with at least one successful upload.
The next 8 fields count which type of
client
program was being used by the remote user. Since FTP has
no equivalent of HTTP's "User-Agent" field, this data is obtained using
heuristics and is not very accurate. The primary way this is
determined is by analyzing the password sent by a user logging in
anonymously; for example, the Netscape web browser uses "
mozilla@" as this password.
Field
15: Total number of
successful logins using
NcFTP Client.
Field 16: Total number of
successful logins using
Netscape
web browsers.
Field 17: Total number of
successful logins using
Microsoft
Internet Explorer.
Field 18: Reserved for
future use.
Field 19: Reserved for
future use.
Field 20: Reserved for
future use.
Field 21: Reserved for
future use.
Field 22: Reserved for
future use.
The next six fields measure the type of
bandwidth
available to the remote
client. This is done by calculating the total throughput of the
session, so this is an estimate.
Field
23: Total number of
successful logins with at least one file transfer whose bandwidth is
33.6 kBps or less.
Field 24: Total number of
successful logins with at least one file transfer whose bandwidth is
between 33.6 and 56 kBps.
Field 25: Total number of
successful logins with at least one file transfer whose bandwidth is
between 56 and 256 kBps.
Field 26: Total number of
successful logins with at least one file transfer whose bandwidth is
between 256 kBps and 10 MBps.
Field 27: Total number of
successful logins with at least one file transfer whose bandwidth is
between 10 and 100 MBps.
Field 28: Total number of
successful logins with at least one file transfer whose bandwidth is
greater than 100 MBps.
The next three fields are reserved for future use.
Field
29: Reserved for
future use.
Field 30: Reserved for
future use.
Field 31: Reserved for
future use.
The next group of fields measure the statistics about
downloaded
files (files sent from
the FTP server machine to the remote client machine).
Field
32: Total number of
downloads attempted.
Field 33: Total number of
successful downloads (result code was
OK).
Field 34: Total number of
downloads with a result of
ABOR (aborted download; see the
xfer log documentation for details on these
result codes.)
Field 35: Total number of
downloads with a result of
ERROR (miscellaneous error).
Field 36: Total number of
downloads with a result of
INCOMPLETE (transfer did not finish).
Field 37: Total number of
downloads with a result of
NOENT (file did not exist).
Field 38: Total number of
downloads with a result of
PERM (permission denied).
Field 39: Reserved for
future use.
Field 40: Reserved for
future use.
Field 41: Total number of
kilobytes downloaded.
Field 42: Reserved for
future use.
Field 43: Reserved for
future use.
Field 44: Reserved for
future use.
Field 45: Total number of
seconds spent downloading.
The next group of fields measure the statistics about
uploaded files
(files sent from the remote client machine to the FTP server machine).
Field
46: Total number of
uploads attempted.
Field 47: Total number of
successful uploads (result code was OK).
Field 48: Total number of
uploads with a result of ABOR (aborted upload)
Field 49: Total number of
uploads with a result of ERROR (miscellaneous error).
Field 50: Total number of
uploads with a result of INCOMPLETE (transfer did not finish).
Field 51: Total number of
uploads with a result of NOENT (file did not exist; should always
be 0).
Field 52: Total number of
uploads with a result of PERM (permission denied).
Field 53: Reserved for
future use.
Field 54: Reserved for
future use.
Field 55: Total number of
kilobytes uploaded.
Field 56: Reserved for
future use.
Field 57: Reserved for
future use.
Field 58: Reserved for
future use.
Field 59: Total number of
seconds spent uploading.
The last field (as of this writing) is...
Field
60: Maximum number
of simultaneous users that were logged in during the interval.
This field is very useful for determining an optimal setting of
max-users.
If your server is frequently at or near the maximum, you may want to
increase
max-users if you
can.
See Also: Transfer
Log Format : Session Log Format
