Log Parser Plus example query

User accounts used in IIS 6 FTP login attempts

The following Log Parser query can be used on FTP log files in order to determine what user names were used to login, or attempt to login, to an FTP site.
Keywords:
  • iis6ftp
Statement:
logparser -rtp:-1 "SELECT cs-uri-stem, count(cs-method) INTO FTPUserAccountAttempts.txt FROM ex*.log WHERE cs-method like '%USER' GROUP BY cs-uri-stem ORDER BY count(cs-method), cs-uri-stem"
Notes: See <a href="http://strivinglife.com/words/post/Using-Log-Parser-to-find-users-accounts-used-to-log-into-an-FTP-site.aspx" rel="external">Using Log Parser to find users accounts used to log into an FTP site</a> for more information. Leave a comment on this query.

View more examples.


blog comments powered by Disqus