Note that depending on your version of NcFTPd, your logs may have fewer fields than those listed here; newer versions will try to maintain backwards compatibility by appending new fields (rather than inserting new fields, deleting old fields, or otherwise modifying the line format).
Prefix 1: Date and time: When the remote client was logged out and disconnected.
Prefix 2: Child number: The name of the child process that served the client connection.
Field 1: User: Username attempted to login as, or anonymous for anonymous FTP users. Note that this field does not imply that user was successfully logged in. There are two special values here: REFUSED and DENIED. The latter refers to remote clients who were refused a connection (or disconnected immediately) because the server was at its max user limit; the former refers to users disconnected immediately because the client address was rejected by TCP Wrappers.
Field 2: Email: Email address as entered by the anonymous FTP user at the password prompt. Will be blank for non-anonymous users.
Field 3: Host: IP or hostname of the remote host the client is originating from.
Field 4: Session time: Total number of seconds user was logged in to the server.
Field 5: Time between commands: Average number of seconds between FTP commands.
Field 6: Bytes retrieved: Total bytes downloaded.
Field 7: Bytes Stored: Total bytes uploaded.
Field 8: Number of commands: Total number of commands the remote FTP client issued.
Field 9: Retrieves: Total number of retrieves (downloads) attempted.
Field 10: Stores: Total number of stores (uploads) attempted.
Field 11: Chdirs: Number of directory changes attempted.
Field 12: NLSTs: Number of directory listings (short mode).
Field 13: LISTs: Number of directory listings (detailed mode).
Field 14: Types: Number of transfer type changes.
Field 15: PORT/PASV: Number of data connection address specifications.
Field 16: PWD: Number of print working directory requests.
Field 17: SIZE: Number of file size requests.
Field 18: MDTM: Number of file modification time requests.
Field 19: SITE: Number of site commands.
Field 20: Logins: Number of successful logins.
Field 21: Failed Data Connections: Number of data connections that could not be established due to some sort of an error (i.e. timed-out during connect to address client specified using PORT).
Field 22: Last transfer result: The status code of the session's last data transfer, or NONE if no transfers were attempted.
Field 23: Successful downloads: Number of successful downloads.
Field 24: Failed downloads: Number of failed downloads.
Field 25: Successful uploads: Number of successful uploads.
Field 26: Failed uploads: Number of failed uploads.
Field 27: Successful listings: Number of successful directory listings.
Field 28: Failed listings: Number of failed directory listings.
Field 29: Close Code: Reason the client was disconnected (see below).
Field 30: Session ID: Unique session identifier. This can be used to match the session with entries in the transfer logs.
Field 31: Domain: Specifies which of your server's domains (set-name) the remote user connected to.
|0||Normal disconnect (client issued QUIT primitive).|
|1||End-of-file on control connection; the client closed the connection but did not issue a QUIT primitive. This should not be considered an error in most cases.|
|3||Client exceeded idle timeout limit.|
|4||Client exceeded login timeout.|
|5||Timed-out while sending to client.|
|6||Lost connection (broken pipe).|
|7||Control connection reset by peer.|
|8||Network I/O error (error reported by read or write system call).|
|9||TCP Wrappers denied the user.|
|10||Too many users already logged on.|
|11||Too many users already logged on to domain.|
|12||Too many users already logged on by the same username.|
|13||Too many users already logged on by the same IP address.|
|14||Bad startup directory.|
|15||Passive data socket failed.|
|16||Passive data connection accept timed-out.|
|17||Passive data connection accept failed.|
|18||Passive data connection accept succeeded, but remote port was under 1024.|
|19||Passive data connection accept succeeded, but remote address was different from that of the control connection and proxy connections are disabled.|
|20||Port data connection attempt to client timed-out.|
|21||Port data connection attempt to client failed.|
|22||Port data connection specified a different remote address than that of the control connection and proxy connections are disabled.|
|23||Port data connection specified an internal network address.|
|24||Port data connection specified a remote port number under 1024.|
|25||Control connection's port number was under 1024.|
|27||ncftpd_authd exchange state failed.|
|28||ncftpd_authd denied the user.|
|29||ncftpd_authd miscellaneous error.|
|30||Too many failed username/password attempts.|
|31||No logins are allowed during system maintenance (/etc/nologin file exists).|
|32||Anonymous logins not allowed here.|
|33||Non-anonymous logins not allowed here.|
|34||Buffer overflow attempted by client.|
|35||Could not restore user privileges.|
|36||Domain is marked as disabled.|
|37||Timed out during data transfer.|
|38||Wrong protocol (such as HTTP or SMTP) used by client.|
|39||Syntax error in passwd database user record.|
|40||Malformed User Permssions String in passwd database user record or from Authd.|
|41||Malformed Umask in passwd database user record or from Authd.|
See Also: Transfer Log Format : Stat Log Format