sftpgo/docs/logs.md

# Logs

The log file is a stream of JSON structs. Each struct has a `sender` field that identifies the log type.

The logs can be divided into the following categories:

- **"app logs"**, internal logs used to debug SFTPGo:
  - `sender` string. This is generally the package name that emits the log
  - `time` string. Date/time with millisecond precision
  - `level` string
  - `message` string
- **"transfer logs"**, SFTP/SCP transfer logs:
  - `sender` string. `Upload` or `Download`
  - `time` string. Date/time with millisecond precision
  - `level` string
  - `local_addr` string. IP/port of the local address the connection arrived on. For FTP protocol this is the address for the control connection. For example `127.0.0.1:1234`
  - `remote_addr` string. IP and, optionally, port of the remote client. For example `127.0.0.1:1234` or `127.0.0.1`
  - `elapsed_ms`, int64. Elapsed time, as milliseconds, for the upload/download
  - `size_bytes`, int64. Size, as bytes, of the download/upload
  - `username`, string
  - `file_path` string
  - `connection_id` string. Unique connection identifier
  - `protocol` string. `SFTP`, `SCP`, `SSH`, `FTP`, `HTTP`, `DAV`, `DataRetention`, `EventAction`
  - `ftp_mode`, string. `active` or `passive`. Included only for `FTP` protocol
- **"command logs"**, SFTP/SCP command logs:
  - `sender` string. `Rename`, `Rmdir`, `Mkdir`, `Symlink`, `Remove`, `Chmod`, `Chown`, `Chtimes`, `Truncate`, `Copy`, `SSHCommand`
  - `level` string
  - `local_addr` string. IP/port of the local address the connection arrived on. For example `127.0.0.1:1234`
  - `remote_addr` string. IP and, optionally, port of the remote client. For example `127.0.0.1:1234` or `127.0.0.1`
  - `username`, string
  - `file_path` string
  - `target_path` string
  - `filemode` string. Valid for sender `Chmod` otherwise empty
  - `uid` integer. Valid for sender `Chown` otherwise -1
  - `gid` integer. Valid for sender `Chown` otherwise -1
  - `access_time` datetime as YYYY-MM-DDTHH:MM:SS. Valid for sender `Chtimes` otherwise empty
  - `modification_time` datetime as YYYY-MM-DDTHH:MM:SS. Valid for sender `Chtimes` otherwise empty
  - `size` int64. Valid for sender `Truncate` otherwise -1
  - `elapsed`, int64. Elapsed time, as milliseconds
  - `ssh_command`, string. Valid for sender `SSHCommand` otherwise empty
  - `connection_id` string. Unique connection identifier
  - `protocol` string. `SFTP`, `SCP`, `SSH`, `FTP`, `HTTP`, `DAV`, `DataRetention`, `EventAction`
- **"http logs"**, REST API logs:
  - `sender` string. `httpd`
  - `level` string
  - `local_addr` string. IP/port of the local address the connection arrived on. For example `127.0.0.1:1234`
  - `remote_addr` string. IP and, optionally, port of the remote client. For example `127.0.0.1:1234` or `127.0.0.1`
  - `proto` string, for example `HTTP/1.1`
  - `method` string. HTTP method (`GET`, `POST`, `PUT`, `DELETE` etc.)
  - `user_agent` string
  - `uri` string. Full uri
  - `resp_status` integer. HTTP response status code
  - `resp_size` integer. Size in bytes of the HTTP response
  - `elapsed_ms` int64. Elapsed time, as milliseconds, to complete the request
  - `request_id` string. Unique request identifier
- **"connection failed logs"**, logs for failed attempts to initialize a connection. A connection can fail for an authentication error or other errors such as a client abort or a timeout if the login does not happen in two minutes
  - `sender` string. `connection_failed`
  - `level` string
  - `username`, string. Can be empty if the connection is closed before an authentication attempt
  - `client_ip` string.
  - `protocol` string. Possible values are `SSH`, `FTP`, `DAV`
  - `login_type` string. Can be `publickey`, `password`, `keyboard-interactive`, `publickey+password`, `publickey+keyboard-interactive` or `no_auth_tryed`
  - `error` string. Optional error description