http://www.pureftpd.org/README wrote:
- '-O <format>:<log file>': Record all file transfers into a specific log
file, in an alternative format. Currently, four formats are supported: CLF
(Apache-like), Stats, W3C and xferlog.
If you add '-O clf:/var/log/pureftpd.log' to your starting options,
Pure-FTPd will log transfers in /var/log/pureftpd.log in a format similar to
the Apache web server in default configuration.
If you use '-O stats:/var/log/pureftpd.log' to your starting options,
Pure-FTPd will create log files in a special format, designed for statistical
reports. The Stats format is compact, more efficient and more accurate that
CLF and the old broken "xferlog" format.
The Stats format is:
<date> <session id> <user> <ip> <U or D> <size> <duration> <file>
<date> is a GMT timestamp (time()) and <session id> identifies the current
session. <file> is unquoted, but it's always the last element of a log line.
"U" means "Upload" and "D" means "Download".
Warning: the session id is only designed for statistics purposes. While it's
always an unique string in the real world, it's theoretically possible to have
it non unique in very rare conditions. So don't rely on it for critical
missions.
A command called "pure-statsdecode" can be used to convert timestamps into
human-readable dates.
The W3C format is enabled with '-O w3c:/var/log/pureftpd.log' .
For security purposes, the path must be absolute (eg. /var/log/pureftpd.log
, not ../log/pureftpd.log) . If this log file is stored on a NFS volume, don't
forget to start the lock manager (often called "lockd" or "rpc.lockd").