The xferlog file contains transfer logging information from the FTP Server, in.ftpd(1M). You can use the logfile capability to change the location of the log file. See ftpaccess(4).
By default, each server entry is composed of a single line of the following form. All fields are separated by spaces.
current-time transfer-time remote-host bytes-transferred filename transfer-type special-action-flag direction access-mode username service-name authentication-method authenticated-user-id completion-status
The xferlog format capability can be used to customize the transfer log file format used. In addition to those in the default format, it also supports chroot-filename, file-size, and restart-offset fields. See ftpaccess(4).
The fields are defined as follows:
current-time The current local time in the form DDD MMM dd hh:mm:ss YYYY, where:
DDD Is the day of the week
MMM Is the month
dd Is the day of the month
hh Is the hour
mm Is the minutes
ss Is the seconds
YYYY Is the year
transfer-time The total time in seconds for the transfer
remote-host The remote host name
bytes-transferred The number of bytes transferred
filename The absolute pathname of the transferred file
transfer-type A single character indicating the type of transfer:
a Indicates an ascii transfer
b Indicates a binary transfer
special-action-flag One or more single character flags that indicate any special action taken. The special-action-flag can have one of more of the following values:
C File was compressed
U File was uncompressed
T File was archived, for example, by using tar(1)
_ (underbar) No action was taken.
direction The direction of the transfer. direction can have one of the following values:
access-mode The method by which the user is logged in. access-mode can have one of the following values:
a For an anonymous user.
g For a passworded guest user. See the description of the guestgroup capability in ftpaccess(4).
r For a real, locally authenticated user
username The local username, or if anonymous, the ID string given
service-name The name of the service invoked, usually ftp
authentication-method The method of authentication used. authentication-method can have one of the following values:
1 RFC 931 authentication
authenticated-user-id The user ID returned by the authentication method. A * is used if an authenticated user ID is not available.
completion-status A single character indicating the status of the transfer. completion-status can have one of the following values:
c Indicates complete transfer
i Indicates incomplete transfer
chroot-filename The pathname of the transferred file relative to the chroot point. This will differ from the filename field for anonymous and guest users.
file-size The size, in bytes, of the file on the server.
restart-offset The offset, in bytes, at which the file transfer was restarted (0 when no restart offset was specified).
See attributes(5) for descriptions of the following attributes:
|ATTRIBUTE TYPE||ATTRIBUTE VALUE|
tar(1), in.ftpd(1M), ftpaccess(4), ftpconversions(4), attributes(5)
StJohns, Mike. RFC 931, Authentication Server. Network Working Group. January 1985.