Specifying Log Format, Type, and Location

To monitor EFT Server activity, you can reference EFT Server’s log files. EFT Server supports W3C, Microsoft IIS, and NCSA log file formats. Server events are logged to a file named [log file format]yymmdd.log, where YY, MM, and DD indicate the numeric year, month, and day respectively. Depending on the log file format selected, a 2-letter abbreviation is prepended to the filename, as described in the table below. For example, a log file in the Microsoft IIS format created on August 22, 2007 is named in070822.log.  

Logs are saved by default to C:\Documents and Settings\All Users\Application Data\GlobalSCAPE\EFT Server Enterprise\Logs or C:\Documents and Settings\All Users\Application Data\GlobalSCAPE\EFT Server\Logs, but you can specify a different location on the Logs tab of the Server, as shown below.

Log Example

Below is an example of an ex-formatted log. (The numbered lines are for discussion purposes only, not part of the log.)

1. #Version: 1.0

2. #Software: CuteLogger

3. #Date: 2010-04-08 20:07:50

4. #Fields: date time c-ip c-port cs-username cs-method cs-uri-stem cs-uri-query sc-status sc-bytes cs-bytes s-name s-port

5. 2010-04-08 20:07:07 192.168.241.1 - test [1]user test - 331 - - - 22

6. 2010-04-08 20:07:07 192.168.241.1 - test [1]pass ******* - 230 - - - 22

7. 2010-04-08 20:07:16 192.168.241.1 - test [1]created /Test+File+1.txt - 226 - 54 - 22

8. 2010-04-08 20:08:23 192.168.241.1 - test [1]rnfr /Test+File+1.txt - 350 - - - 22

9. 2010-04-08 20:08:23 192.168.241.1 - test [1]rnto /Test+File+2.txt - 250 - - - 22

10. 2010-04-08 20:08:26 192.168.241.1 - test [1]sent /Test+File+2.txt - 226 - 54 - 22

11. 2010-04-08 20:10:02 192.168.241.1 - test [1]dele /Test+File+2.txt - 250 - - - 22

12. 2010-04-08 20:10:08 192.168.241.1 - test [1]ssh_disconnect timeout - 421 - - - 22

13. 2010-04-08 20:10:09 192.168.241.1 - test [1]ssh_disconnect timeout - 421 - - - 22

14. 2010-04-08 20:11:57 192.168.241.1 - test [2]user test - 331 - - - 990

15. 2010-04-08 20:11:57 192.168.241.1 - test [2]pass ****** - 230 - - - 990

16. 2010-04-08 20:12:04 192.168.241.1 - test [2]created /Test+File+1.txt - 226 - 54 - 990

17. 2010-04-08 20:12:16 192.168.241.1 - test [2]rnfr /Test+File+1.txt - 350 - - - 990

18. 2010-04-08 20:12:16 192.168.241.1 - test [2]rnto /Test+File+2.txt - 250 - - - 990

19. 2010-04-08 20:12:28 192.168.241.1 - test [2]rnfr /Test+File+2.txt - 350 - - - 990

20. 2010-04-08 20:12:28 192.168.241.1 - test [2]rnto /Test+File+3.txt - 250 - - - 990

21. 2010-04-08 20:12:31 192.168.241.1 - test [2]sent /Test+File+3.txt - 226 122 - - 990

The log can be read as described below:

To specify log settings

1. In the EFT Server administration interface, connect to EFT Server and click the Server tab.

2. In the left pane, click the Server node.

3. In the right pane, click the Logs tab.

   

4. In the Folder in which to save log files box, type the path to the directory in which to save this Server's log files. To browse for a path, click the folder icon .

   By default, log files are saved in the EFT Server data directory in the Log folder (e.g., C:\Documents and Settings\All Users\Application Data\GlobalSCAPE\EFT Server Enterprise\Logs).

5. In the Log file format list, click W3C Extended, Microsoft IIS, NCSA Common, or No Logging.

   Changing the log file format disconnects all active users. It is recommended to stop all Sites or wait until all users are inactive before changing the log file format. The W3C format records all times in GMT (Greenwich Mean Time).

6. In the Log type list, click Standard or Verbose. (Verbose provides more details, but makes larger files.)

7. In the Rotate Log File area, specify Never, Daily, Weekly, or Monthly.

8. Click Apply to save the changes on EFT Server.

9. Stop and restart EFT Server.

   Logs are not written to disk in real time. As events occur, EFT Server buffers those events in real time and then flushes (writes) them to file after either a) 60 lines are available or b) 32kb of log data is received in 1 second or less.