How do I monitor login attempts to IIS FTP ?

[lozina]

I noticed the EventLog fill up today on our server and when I looked it had hundreds of login attempt failures to our FTP service, MSFTPSVC. Does anyone know how I can configure this FTP so that it logs all unsuccessful login attempts, with the IP address?

Only thing I can think of doing for now is to run Ethereal packet sniffer and capture anything on port 21.

 

[Thor86]

In IIS Manager, you can modify what gets logged in your FTP (ip address, etc). By default, they don't log much.

 

[cyberia]

Try Control Panel -> Admin Tools -> Internet Info Services. Right-click on the FTP Site and go to Properties.

In the Logging section, click on Properties and go to the Extended Properties tag and check off Client IP address. Check C:\WINDOWS\system32\LogFiles\MSFTPSVC1\ for the log file.