Getting a log of client commands and responses

Question

A customer asked:

How can we get a log of the exact commands sent by clients connecting to our CompleteFTP server? The INFO logs are not detailed enough, and the DEBUG logs provide way too much under the hood info. When troubleshooting with our customers, we need to just see the commands that they are sending. This is a crucial to troubleshooting a wide variety of clients connecting to our server.

Answer 1

Yes, you can do this.

Please follow the instructions in How to log to syslog, except in step 2 instead of pasting in the appender definition for Syslog, use the following appender definition:

<appender name="Commands" type="log4net.Appender.RollingFileAppender">
  <encoding value="utf-8" />
  <filter type="log4net.Filter.StringMatchFilter">
	<stringToMatch value="CMD" />
	<acceptOnMatch value="true" />
  </filter>
  <filter type="log4net.Filter.StringMatchFilter">
	<stringToMatch value="SSH_FXP" />
	<acceptOnMatch value="true" />
  </filter>
  <filter type="log4net.Filter.DenyAllFilter" />
  <file type="log4net.Util.PatternString">
	<converter>
	  <name value="folder" />
	  <type value="EnterpriseDT.Util.Debug.SpecialFolderPatternConverter" />
	</converter>
	<conversionPattern value="%folder{CommonApplicationData}\Enterprise Distributed Technologies\Complete FTP\logs\Commands.log" />
  </file>
  <param name="AppendToFile" value="true" />
  <param name="RollingStyle" value="Date" />
  <param name="DatePattern" value=".yyyyMMdd" />
  <layout type="log4net.Layout.PatternLayout">
	<param name="Header" value="" />
	<param name="Footer" value="" />
	<param name="ConversionPattern" value="%date{dd MMM yyyy HH:mm:ss}	%message	%newline"         />
  </layout>
</appender>

and instead of referencing Syslog in definition of <root>, use the following:

<appender-ref ref="Commands" />

I have to warn you that running CompleteFTP with debug logging slows it down because I writes so much logging. I therefore recommend that you only set it to Debug level when you’re trying to diagnose a problem and leave it at Information otherwise.