"Transfer Log" (xfer log) is a misnomer; the log is actually closer to a transaction log which logs not only uploads and downloads, but also other operations such as deletes, directory listings, and renames. Note that depending on your version of NcFTPd, your logs may have fewer fields than those listed here; newer versions will try to maintain backwards compatibility by appending new fields (rather than inserting new fields, deleting old fields, or otherwise modifying the line format).
Prefix 1: Date and time: Time when the transfer operation finished.
Prefix 2: Child number: The name of the child process
that served the client connection.
Field 1: Type of log entry. Note that prior to version 2.2.2 of NcFTPd the only log entry types were S and R.
| Value | Meaning |
| R | Retrieve operation (download from server) |
| S | Store operation (upload to server) |
| T | Directory listing operation |
| D | Delete operation (file or empty directory removed successfully) |
| M | Mkdir operation (directory creation) succeeded |
| C | Chmod operation succeeded |
| L | Symbolic link operation succeeded. |
| N | Rename operation succeeded |
This section only applies to the S and R log entry types.
Field 2: Pathname: Name of the file on the server.
Field 3: Size: How many bytes were transferred.
This is not necessarily the size of the file on the client side, and the
size may be smaller than expected if the transfer does not complete.
Field 4: Duration: Elapsed time in seconds.
Field 5: Rate: Transfer throughput rate, in kilobytes
per second.
Field 6: User: Username logged in under, or anonymous
for anonymous FTP users.
Field 7: Email: Email address as entered by the
anonymous FTP user at the password prompt. Will be blank for non-anonymous
users.
Field 8: Host: IP or hostname of the remote host
the client is originating from.
Field 9: Suffix: If an "on-the-fly"
translation method was used, this was the suffix requested.
| Value | Meaning |
| .tar | Directory retrieved as a TAR file. |
| .tar.Z | Directory retrieved as a compressed TAR file. |
| .tar.gz | Directory retrieved as gzipped TAR file. |
| (blank) | Nothing special was used. |
| Value | Meaning |
| OK | File was completely transferred successfully. |
| ABOR | File was aborted by the remote client or forcefuly closed
by the client ( |
| INCOMPLETE | Data transfer connection to remote client was lost, such as network I/O
timing out. This could also be a result of a forcefully closed
connection by the client ( |
| PERM | The client did not have sufficient access privileges to transfer the file
(" |
| NOENT | The client program requested a file that did not exist. |
| ERROR | Miscellaneous I/O error. |
Field 11: Transfer Type: How the file was transferred:
| Value | Meaning |
| A | File was transferred as ASCII text. |
| I | File was transferred in binary (image). |
Field 12: Transfer notes: Additional information on how the transfer was
implemented. Zero or more flags below may be indicated; when more than one
flag is indicated, they will be appended to each other in no particular order,
such as "
| Value | Meaning |
| Df | FTP default data connection (non-passive out to port 20) was used (rare). |
| Po | PORT (non-passive) data connection was used. |
| Ps | PASV (passive) data connection was used. |
| Mm | Memory mapped I/O was used. |
| Bl | Block transfer mode was used (very rare; obselete). |
| Sf | Sendfile optimization was used. |
Field 13: Start of transfer: The
timestamp when the transfer really started. Due to how transfers are
logged, it is not necessarily true that the start time is the time of the
log entry minus the elapsed time. The timestamp is the "
Field 14: Session ID: Unique session
identifier generated for the user's FTP session.
You can use this field to match session log information with transfer logs.
Field 15: Starting size: Size of the file
in bytes when the transfer started.
May be
Field 16: Starting offset: The position in the file
in bytes when the transfer started.
This will be 0 for most transfers, and greater than zero if an FTP
REST (restart) command was used (common when resuming transfers).
May be
This section only applies to the T (directory listing)
log entry type.
Field 2: Pathname: Absolute pathname of the directory (or filename) on the server that was
listed.
Field 3: Completion: Listing completion
status. The status codes correspond to that of upload
and downloads.
Field 4: Pattern: If the user requested a wildcard expression to filter the listing this field will contain the expression, otherwise it will be empty.
Field 5: Recursion: If the user requested a recursive directory
traversal, this field will contain "
Field 6: User: Username logged in under, or anonymous
for anonymous FTP users.
Field 7: Email: Email address as entered by the
anonymous FTP user at the password prompt. Will be blank for non-anonymous
users.
Field 8: Host: IP or hostname of the remote host
the client is originating from.
Field 9: Session ID: Unique session
identifier generated for the user's FTP session.
You can use this field to match session log information with transfer logs.
This section only applies to the D (deletion) log entry type.
Field 2: Pathname: Absolute pathname of the file (or empty directory) on the server that was deleted.
Fields 3, 4, 5: Reserved: (Empty)
Field 6: User: Username logged in under, or anonymous
for anonymous FTP users.
Field 7: Email: Email address as entered by the
anonymous FTP user at the password prompt. Will be blank for non-anonymous
users.
Field 8: Host: IP or hostname of the remote host
the client is originating from.
Field 9: Session ID: Unique session
identifier generated for the user's FTP session.
You can use this field to match session log information with transfer logs.
This section only applies to the M (mkdir) log entry type.
Field 2: Pathname: Absolute pathname of the new directory on the server that was created.
Fields 3, 4, 5: Reserved: (Empty)
Field 6: User: Username logged in under, or anonymous
for anonymous FTP users.
Field 7: Email: Email address as entered by the
anonymous FTP user at the password prompt. Will be blank for non-anonymous
users.
Field 8: Host: IP or hostname of the remote host
Field 9: Session ID: Unique session
identifier generated for the user's FTP session.
You can use this field to match session log information with transfer logs.
the client is originating from.
This section only applies to the C (chmod) log entry type.
Field 2: Pathname: Absolute pathname of the file or directory on the server that was changed.
Field 3: Mode: Mode (in octal).
Fields 4, 5: Reserved: (Empty)
Field 6: User: Username logged in under, or anonymous
for anonymous FTP users.
Field 7: Email: Email address as entered by the
anonymous FTP user at the password prompt. Will be blank for non-anonymous
users.
Field 8: Host: IP or hostname of the remote host
Field 9: Session ID: Unique session
identifier generated for the user's FTP session.
You can use this field to match session log information with transfer logs.
the client is originating from.
This section only applies to the L (symlink) log entry type.
Field 2: Pathname: Absolute pathname of the existing file or directory on the server that was
linked from.
Field 3: Reserved: (Contains the text "to")
Field 4: Pathname: Absolute pathname on the server that it was linked
to.
Field 5: Reserved: (Empty)
Field 6: User: Username logged in under, or anonymous
for anonymous FTP users.
Field 7: Email: Email address as entered by the
anonymous FTP user at the password prompt. Will be blank for non-anonymous
users.
Field 8: Host: IP or hostname of the remote host
Field 9: Session ID: Unique session
identifier generated for the user's FTP session.
You can use this field to match session log information with transfer logs.
the client is originating from.
This section only applies to the N (rename) log entry type.
Field 2: Pathname: Absolute pathname of the existing file or directory on the server that was renamed from.
Field 3: Reserved: (Contains the text "to")
Field 4: Pathname: Absolute pathname on the server that it was renamed to.
Field 5: Reserved: (Empty)
Field 6: User: Username logged in under, or anonymous
for anonymous FTP users.
Field 7: Email: Email address as entered by the
anonymous FTP user at the password prompt. Will be blank for non-anonymous
users.
Field 8: Host: IP or hostname of the remote host
the client is originating from.
Field 9: Session ID: Unique session
identifier generated for the user's FTP session.
You can use this field to match session log information with transfer logs.
See Also: Session Log Format : Stat Log Format
