Monitoring and Logging

Monitoring and logging are essential for maintaining a healthy CompleteFTP server. The CLI provides tools for configuring log levels, auditing file transfer activity, and recording events for analysis. Proper logging configuration helps with troubleshooting, compliance, and performance tuning.

Overview

CompleteFTP monitoring and logging includes:

• Log levels - Control the verbosity of server logging output
• Auditing - Record file transfer and user activity for compliance and review
• Event recording - Capture server events for analysis and reporting
• Log file management - Rolling files, retention, and cleanup
• systemd integration - Access logs through the Linux journal

All monitoring operations use the completeftp monitor command group.

Viewing Monitoring Settings

Show All Settings

# Show all monitoring settings
completeftp monitor show

This displays the current configuration for logging, auditing, and event recording.

Show Specific Settings

# Show only the log level
completeftp monitor show logging.level

# Show auditing settings
completeftp monitor show auditing.enabled auditing.useRollingFiles auditing.maxRollingFiles

# Show event recording settings
completeftp monitor show eventRecording.enabled eventRecording.importAuditing

Log Levels

CompleteFTP supports four log levels, each including all messages from higher-severity levels.

Available Log Levels

Setting the Log Level

# Set log level to Debug for troubleshooting
completeftp monitor set logging.level=Debug

# Return to normal logging after troubleshooting
completeftp monitor set logging.level=Information

# Minimal logging for high-traffic servers
completeftp monitor set logging.level=Warning

# Errors only
completeftp monitor set logging.level=Error

When to Use Each Level

Error -- Use on high-traffic production servers where disk space is a concern and the server is running reliably. Only critical failures are logged.

Warning -- Use on stable production servers where you want early visibility into potential problems without the volume of informational messages.

Information -- The default level. Suitable for most production deployments. Logs connection events, authentication results, and file transfer summaries.

Debug -- Use temporarily when diagnosing a specific issue. Debug logging produces significant output and can affect performance on busy servers. Always return to Information or Warning after troubleshooting.

Auditing

Auditing records detailed file transfer activity, including uploads, downloads, logins, and other user operations. Audit data is essential for compliance requirements and security reviews.

Enable or Disable Auditing

# Enable auditing
completeftp monitor set auditing.enabled=true

# Disable auditing
completeftp monitor set auditing.enabled=false

# Check current auditing status
completeftp monitor show auditing.enabled

Rolling Audit Files

By default, CompleteFTP writes audit data to rolling files, creating a new file each day and retaining a configurable number of historical files.

# Enable rolling audit files (default)
completeftp monitor set auditing.useRollingFiles=true

# Disable rolling files (store audit data in the config database instead)
completeftp monitor set auditing.useRollingFiles=false

Audit File Retention

Control how many rolling audit files are retained. Older files are automatically deleted.

# Keep 365 days of audit files (default)
completeftp monitor set auditing.maxRollingFiles=365

# Keep 90 days for environments with limited storage
completeftp monitor set auditing.maxRollingFiles=90

# Keep 730 days (2 years) for compliance requirements
completeftp monitor set auditing.maxRollingFiles=730

# Check current retention setting
completeftp monitor show auditing.maxRollingFiles

Auditing Property Reference

Event Recording

Event recording captures server events for analysis and reporting. When combined with auditing, it provides a comprehensive view of server activity.

Enable or Disable Event Recording

# Enable event recording (default)
completeftp monitor set eventRecording.enabled=true

# Disable event recording
completeftp monitor set eventRecording.enabled=false

# Check current status
completeftp monitor show eventRecording.enabled

Import Auditing Data

Event recording can import data from auditing to provide a unified view of all server activity.

# Enable importing audit data into event recording
completeftp monitor set eventRecording.importAuditing=true

# Disable importing audit data (default)
completeftp monitor set eventRecording.importAuditing=false

Event Recording Property Reference

Log File Locations on Linux

CompleteFTP stores log and audit files in standard Linux locations.

Main Server Log

The primary server log is written to:

/var/lib/completeftp/log/

# List log files
ls -la /var/lib/completeftp/log/

# View the most recent log entries
tail -f /var/lib/completeftp/log/*.log

Audit Files

When rolling files are enabled, audit files are stored alongside the main log in the CompleteFTP data directory. When rolling files are disabled, audit data is stored in the configuration database.

systemd Journal

CompleteFTP integrates with the Linux systemd journal, providing an additional way to access server logs.

# View all CompleteFTP journal entries
journalctl -u completeftp

# Follow log output in real time
journalctl -u completeftp -f

# View logs from the last hour
journalctl -u completeftp --since "1 hour ago"

# View logs from a specific date range
journalctl -u completeftp --since "2026-03-15" --until "2026-03-16"

# View only error-level messages
journalctl -u completeftp -p err

# View logs from the current boot
journalctl -u completeftp -b

# Show the last 50 lines
journalctl -u completeftp -n 50

Log Rotation and Cleanup

Rolling File Rotation

CompleteFTP handles rolling audit file rotation automatically when auditing.useRollingFiles is enabled. A new file is created each day, and files older than the auditing.maxRollingFiles threshold are deleted.

# Configure retention period
completeftp monitor set auditing.maxRollingFiles=180

# Verify the setting
completeftp monitor show auditing.maxRollingFiles

systemd Journal Cleanup

The systemd journal has its own retention settings managed by the operating system.

# Check journal disk usage
journalctl --disk-usage

# Retain only the last 7 days of journal entries (requires root)
journalctl --vacuum-time=7d

# Limit journal size to 500 MB (requires root)
journalctl --vacuum-size=500M

For persistent journal configuration, edit /etc/systemd/journald.conf:

# View current journald configuration
cat /etc/systemd/journald.conf

# After editing, restart journald to apply changes
systemctl restart systemd-journald

Disk Space Monitoring

On production servers, monitor disk usage to prevent log files from consuming all available space.

# Check disk usage of the CompleteFTP data directory
du -sh /var/lib/completeftp/log/

# Check overall disk usage
df -h /var/lib/completeftp/

Workflow Examples

Initial Production Setup

Configure monitoring settings appropriate for a new production server:

# 1. Verify default settings
completeftp monitor show

# 2. Set log level to Information (default)
completeftp monitor set logging.level=Information

# 3. Enable auditing with rolling files
completeftp monitor set auditing.enabled=true
completeftp monitor set auditing.useRollingFiles=true

# 4. Set retention to match your compliance requirements
completeftp monitor set auditing.maxRollingFiles=365

# 5. Enable event recording
completeftp monitor set eventRecording.enabled=true

# 6. Verify final configuration
completeftp monitor show

Temporary Debug Logging

Enable debug logging to investigate a specific issue, then restore normal logging:

# 1. Record the current log level
completeftp monitor show logging.level

# 2. Enable debug logging
completeftp monitor set logging.level=Debug

# 3. Follow the log in real time while reproducing the issue
journalctl -u completeftp -f

# 4. After capturing the issue, restore normal logging
completeftp monitor set logging.level=Information

High-Traffic Server Configuration

Optimize logging for a server handling large volumes of transfers:

# 1. Reduce log verbosity to Warning
completeftp monitor set logging.level=Warning

# 2. Keep auditing enabled but limit retention
completeftp monitor set auditing.enabled=true
completeftp monitor set auditing.useRollingFiles=true
completeftp monitor set auditing.maxRollingFiles=90

# 3. Disable event recording if not needed
completeftp monitor set eventRecording.enabled=false

# 4. Verify configuration
completeftp monitor show

Compliance-Focused Configuration

Configure logging for environments with strict audit requirements:

# 1. Keep Information-level logging
completeftp monitor set logging.level=Information

# 2. Enable auditing with extended retention
completeftp monitor set auditing.enabled=true
completeftp monitor set auditing.useRollingFiles=true
completeftp monitor set auditing.maxRollingFiles=730

# 3. Enable event recording with audit import
completeftp monitor set eventRecording.enabled=true
completeftp monitor set eventRecording.importAuditing=true

# 4. Verify configuration
completeftp monitor show

Troubleshooting

No Log Output

# Check that the CompleteFTP service is running
systemctl status completeftp

# Check the systemd journal for startup errors
journalctl -u completeftp -n 50

# Verify the log directory exists and has correct permissions
ls -la /var/lib/completeftp/log/

# Ensure the log level is not set too high
completeftp monitor show logging.level

Audit Files Not Being Created

# Verify auditing is enabled
completeftp monitor show auditing.enabled

# Verify rolling files are enabled
completeftp monitor show auditing.useRollingFiles

# Check disk space
df -h /var/lib/completeftp/

# Check directory permissions
ls -la /var/lib/completeftp/

Log Files Consuming Too Much Disk Space

# Check current disk usage
du -sh /var/lib/completeftp/log/

# Reduce audit file retention
completeftp monitor set auditing.maxRollingFiles=90

# Reduce log verbosity
completeftp monitor set logging.level=Warning

# Clean up systemd journal
journalctl --vacuum-time=7d

Debug Logging Not Showing Expected Detail

# Confirm the log level is set to Debug
completeftp monitor show logging.level

# Set to Debug if not already
completeftp monitor set logging.level=Debug

# Follow the journal output to see debug messages in real time
journalctl -u completeftp -f

# Remember to restore the log level after troubleshooting
completeftp monitor set logging.level=Information

Viewing Logs for a Specific Time Window

# View logs around the time an issue occurred
journalctl -u completeftp --since "2026-03-16 14:00:00" --until "2026-03-16 15:00:00"

# View logs from the last 30 minutes
journalctl -u completeftp --since "30 minutes ago"

Best Practices

Production Logging

1. Use Information level -- The default level provides a good balance of visibility and performance for most production servers
2. Keep auditing enabled -- Audit data is critical for security review and compliance reporting
3. Use rolling files -- Rolling audit files are easier to manage and prevent database bloat
4. Set appropriate retention -- Match auditing.maxRollingFiles to your organization's compliance requirements

Performance

1. Avoid Debug in production -- Debug logging generates significant output and can degrade performance on busy servers
2. Monitor disk space -- Log and audit files grow over time; set up alerts for low disk conditions
3. Tune retention -- On high-traffic servers, shorter retention periods reduce disk usage
4. Disable unused features -- Turn off event recording or audit import if they are not needed

Security and Compliance

1. Do not disable auditing -- Audit trails are essential for detecting unauthorized access and meeting compliance requirements
2. Protect log files -- Ensure only authorized administrators can access log and audit files
3. Retain logs appropriately -- Many regulations require minimum retention periods (e.g., 1 year, 7 years)
4. Review logs regularly -- Establish a routine for reviewing logs to detect anomalies early

Troubleshooting Workflow

1. Start with the journal -- Use journalctl -u completeftp for quick access to recent log entries
2. Enable Debug temporarily -- Switch to Debug level only when investigating a specific issue
3. Capture the time window -- Note the time range when an issue occurs and filter logs accordingly
4. Restore normal logging -- Always return to Information or Warning level after troubleshooting

Quick Reference

Monitor Commands

# Show all monitoring settings
completeftp monitor show

# Show specific settings
completeftp monitor show <property> [<property> ...]

# Set a monitoring property
completeftp monitor set <property>=<value>

All Properties

logging.level              = Debug | Information | Warning | Error
auditing.enabled           = true | false
auditing.useRollingFiles   = true | false
auditing.maxRollingFiles   = <number>
eventRecording.enabled     = true | false
eventRecording.importAuditing = true | false

Log File Locations

/var/lib/completeftp/log/    # Main server log directory
journalctl -u completeftp    # systemd journal entries

Common Journal Commands

journalctl -u completeftp              # All entries
journalctl -u completeftp -f           # Follow in real time
journalctl -u completeftp -n 100       # Last 100 lines
journalctl -u completeftp -p err       # Errors only
journalctl -u completeftp --since "1 hour ago"   # Last hour
journalctl -u completeftp -b           # Current boot only