FTP Server Logs

[Michael_Schyma1]

How would i configure Splunk to input all FTP logs from my Splunk server? Anybody have any suggestions on what they do, or Splunk documenation on this topic. (At this point all of the logs will be sent to the Splunk server via univeral forwarder)

[yannK · Accepted solution]

if the logs are in the same server in the folder
/mylog/ftp/ and look like myftp.log (or myftp.log.1 or myftp.log.2.gz etc...)

Collect a sample and index it using the manager, it will help you figure the best sourcetype configuration (linebreak parsing, timestamp detection...)

Then once done create a monitor input on the folder/logfile using the manager or the configuration file.
[monitor:///mylog/ftp/myftp.*]
sourcetype=mysourcetypefortmyftp

If the log files are not on the same server than your splunk indexer, then you can install the universal forwarder as an agent on the box that has the logs (and make sure to define the sourcetype in props.conf on the indexer).
Or an alternative is to use a network mount for the log folder no the splunk indexer.

[Ayn]

What ftpd are we talking about? Do you have log samples?

[sdaniels]

You have a splunk forwarder on the FTP server currently? That is the most straightforward way to monitor any logs on that or any server. Is there an issue or are you just looking for another way?