User accounts used in IIS 6 FTP login attempts

Log Parser Plus example query

User accounts used in IIS 6 FTP login attempts

The following Log Parser query can be used on FTP log files in order to determine what user names were used to login, or attempt to login, to an FTP site.

Keywords:

iis6ftp

Statement:

logparser -rtp:-1 "SELECT cs-uri-stem, count(cs-method) INTO FTPUserAccountAttempts.txt FROM ex*.log WHERE cs-method like '%USER' GROUP BY cs-uri-stem ORDER BY count(cs-method), cs-uri-stem"

Notes: See Using Log Parser to find users accounts used to log into an FTP site for more information. Leave a comment on this query.

View more examples.