Decoding FTP’s xferlog

I was messing around with FTP and needed to decode the log file. It contains lines such as

Thu Nov  9 03:11:13 2006 1 xxx.xxx.xxx.xxx 35 /ftp/pub/anonymous/incoming/test.txt b _ i a IEUser@ ftp 0 * c

but what does this mean? Time to find out… Off to the WU-FTP website

Field

Width

Meaning

Sample

current-time

23

the current local time in the form “DDD MMM dd hh:mm:ss YYYY”. Where DDD is the day of the week, MMM is the month, dd is the day of the month, hh is the hour, mm is the minutes, ss is the seconds,
and YYYY is the year.

Thu Nov  9 03:11:13 2006

transfer-time

Variable

the total time in seconds for the transfer.

1

remote-host

Variable the remote host name xxx.xxx.xxx.xxx
file-size Variable the size of the transferred file in bytes 35
file-name Variable the name of the transferred file /ftp/pub/anonymous/incoming/test.txt
transfer-type 1 a single character indicating the type of transfer. Can be one of:
 a for an ascii transfer
 b for a binary transfer
b
special-action-flag Variable one or more single character flags  indicating any special action taken..   Can be one or more of:
 C file was compressed
 U file was uncompressed
 T file was tar’ed
 _ no action was taken
_
direction 1 the direction of the transfer. Can be one of:
 o outgoing
 i incoming
i
access-mode 1

the method by which the user is logged in. Can be one of:
 a (anonymous) is for an anonymous guest user.
 g (guest) is for a passworded guest user. (see the guestgroup command in ftpaccess(5) )
 r (real) is for a local authenticated user.

a
username Variable the local username, or if guest, the ID string given IEUser@
service-name Variable (Typically 3) the name of the service being invoked, usually FTP ftp
authentication-mode 1

the method of authentication used.
 Can be one of:
 0 none
 1 RFC931 Authentication

0
authenticated-user-id Variable the user id returned by the authentication method. A * is used if an authenticated user id is not available. *
completion-status 1 a single character indicating the status of the transfer. Can be one of:
 c complete transfer
 i incomplete transfer
c