Getting Data In

FTP Server Logs

Michael_Schyma1
Contributor

How would i configure Splunk to input all FTP logs from my Splunk server? Anybody have any suggestions on what they do, or Splunk documenation on this topic. (At this point all of the logs will be sent to the Splunk server via univeral forwarder)

Tags (3)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

if the logs are in the same server in the folder
/mylog/ftp/ and look like myftp.log (or myftp.log.1 or myftp.log.2.gz etc...)

Collect a sample and index it using the manager, it will help you figure the best sourcetype configuration (linebreak parsing, timestamp detection...)

Then once done create a monitor input on the folder/logfile using the manager or the configuration file.
[monitor:///mylog/ftp/myftp.*]
sourcetype=mysourcetypefortmyftp

If the log files are not on the same server than your splunk indexer, then you can install the universal forwarder as an agent on the box that has the logs (and make sure to define the sourcetype in props.conf on the indexer).
Or an alternative is to use a network mount for the log folder no the splunk indexer.

View solution in original post

yannK
Splunk Employee
Splunk Employee

if the logs are in the same server in the folder
/mylog/ftp/ and look like myftp.log (or myftp.log.1 or myftp.log.2.gz etc...)

Collect a sample and index it using the manager, it will help you figure the best sourcetype configuration (linebreak parsing, timestamp detection...)

Then once done create a monitor input on the folder/logfile using the manager or the configuration file.
[monitor:///mylog/ftp/myftp.*]
sourcetype=mysourcetypefortmyftp

If the log files are not on the same server than your splunk indexer, then you can install the universal forwarder as an agent on the box that has the logs (and make sure to define the sourcetype in props.conf on the indexer).
Or an alternative is to use a network mount for the log folder no the splunk indexer.

Ayn
Legend

What ftpd are we talking about? Do you have log samples?

0 Karma

sdaniels
Splunk Employee
Splunk Employee

You have a splunk forwarder on the FTP server currently? That is the most straightforward way to monitor any logs on that or any server. Is there an issue or are you just looking for another way?

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...