Overview
FileZilla Server is a free, open-source FTP and SFTP server for Windows. This article explains how to forward FileZilla Server logs to Logsign Unified SecOps Platform for security analytics and forensic purposes.
Logsign parses both FileZilla Server log formats:
- 0.9.x series (legacy, e.g.
(000027) 6/22/2016 10:06:53 AM - user (ip)> ...) - 1.x series (current, ISO-8601 timestamp with
>>/<</!!/==direction markers), from FileZilla Server 1.0.0 onward
Which format your server produces depends on your FileZilla Server version; both are supported and do not require any special configuration on the Logsign side.
Prerequisites
- All Logsign versions support this integration.
Settings
Forwarding settings are completed as follows:
- Enable logging in FileZilla Server: Server > Settings > Logging, and set a log file path.
- Forward the log file to Logsign using an SMB share pointed at the log file's directory, or a local syslog forwarding agent (e.g. NXLog) configured to tail the log file. Both are supported collection methods on the Logsign side; this article does not mandate one. (Unverified: the exact forwarding method has not been confirmed against a live FileZilla Server deployment. Confirm which collection method matches your environment before configuring the source.)
- Add the source in Logsign: Settings > Data Collection > + Device, and select the collection method matching your forwarding choice (SMB or Syslog).
Sample Log Examples
1.x format:
Jun 19 15:22:32 WINNERSRV 2026-06-19T12:22:31.863Z >> [FTP Session 3990 192.168.41.26 nebim] STOR SFA2026000016298.xml
... 2026-06-19T12:22:31.847Z << [FTP Session 3990 192.168.41.26] 230 Login successful.0.9.x format (legacy):
(000027) 6/22/2016 10:06:53 AM - user (ip)> USER user