FTP generates an
audit log to keep track of user activity. The system will record the event when
each time a user takes any of the following actions:
- Logging in or out
- Renaming or deleting a file
- Retrieving, appending or storing a file
- Creating or removing a directory
The system also records when a session timeout occurs.
Each log file is a tab-delimited text file containing one line per FTP event. Besides logging the date and time at which an event occurs, the system logs the user name and IP address of the client and a description of the executed command. The newest log file is called ftp.log, and the older files are called ftpn.log (the larger the value of n, the older the file).