Log Parser Plus example query
User accounts used in IIS 6 FTP login attempts
The following Log Parser query can be used on FTP log files in order to determine what user names were used to login, or attempt to login, to an FTP site.
Statement:Notes: See Using Log Parser to find users accounts used to log into an FTP site for more information. Leave a comment on this query.
logparser -rtp:-1 "SELECT cs-uri-stem, count(cs-method) INTO FTPUserAccountAttempts.txt FROM ex*.log WHERE cs-method like '%USER' GROUP BY cs-uri-stem ORDER BY count(cs-method), cs-uri-stem"
blog comments powered by Disqus