Synopsis

The page contains patterns examples of FTP Server Logs such as VSFTPD.
The FTP server generates log files containing messages that record all types of events, including errors, warning messages, and access information.

Examples

Example 1 - VSFTPD Log:

VSFTPD, (or very secure FTP daemon), is an FTP server for Unix-like systems, including Linux. It is licensed under the GNU General Public License. It supports IPv6 and SSL.

VSFTPD Log Sample: 

Tue Aug  5 09:41:06 2014 [pid 9411] CONNECT: Client "103.5.6.247"

Tue Aug  5 09:41:06 2014 [pid 9411] FTP response: Client "103.5.6.247", "220 Welcome to Trend Micro BA FTP service."

Tue Aug  5 09:41:06 2014 [pid 9411] FTP command: Client "103.5.6.247", "USER anonymous"

VSFTPD Log Pattern: 

{date:Date,locale=en,EEE MMM  d hh:mm:ss yyyy} [pid {text:PID}]{block,start,emptiness=true} [{text:User}] {block,end,emptiness=true}{text:Operation}: Client "{text:Client}"{block,start,emptiness=true}, "{string:Message}{block,end,emptiness=true}

Links

Template applying instructions:

1. Download the template - VSFTPD - Template

2. Import the template (see Importing a Template)

3. Apply the template on multiple logs (see Applying a Template on Multiple Logs)