Tracing Earlier FTP activity to user/process

[comarow]

I'm sure I'm missing something obvious, but I"m not that used to Multinet as opposed to TCPIP.

How can I go back and trace who did FTP activites during the day? In my case, looking
back at use earlier in the day.

[Jim_McKinney · Accepted solution]

By default...

Outbound? you can't unless you've got image accounting enabled.

Inbound? each successful connection results in the creation of a FTP_SERVER.LOG file in the users' home directory - of course there's nothing to prevent the users from having deleted these (and they are also potentially governed by an logical name imposed version limited). You could scan for these.

With the current version of MultiNet you could enable the session accounting logger for FTP (see Ch 18 of the Admin Guide). I've never used it but it purports to be able to keep a log of both client and server sessions.

You could also set a security alarm on the associated executables.

[Richard Whalen]

The first reply does a very good job of listing the options.

The session accounting that is available in MultiNet FTP logs the following information at the end of each FTP session:
USERNAME, local and remote IP addresses, # files sent, # files received, KBytes sent, KBytes received, start and end time.