Skip to main content
Webalizer FTP is the same Webalizer engine pointed at FTP server logs instead of Apache logs. If your account doesn’t accept FTP traffic (most don’t, beyond your own deploys), the report will be near-empty.
Webalizer FTP report selector

​
What it tracks

FTP-specific equivalents of the regular Webalizer report:
  • Hits: file transfers (uploads + downloads).
  • Files: distinct files transferred.
  • KBytes: bytes moved over FTP.
  • Visits: distinct FTP sessions.
  • Hosts: distinct client IPs.
  • Top URLs: most-touched files.
  • Top entry/exit URLs: where FTP sessions started and ended (approximated by directory).
The output style is identical to Webalizer for HTTP, just with FTP terminology.

​
When this is useful

  • You run an FTP drop for clients to deliver files. A photographer collecting RAW images from a shoot, a vendor uploading invoices weekly. Webalizer FTP shows who connected and how much they pushed.
  • You suspect the FTP service is being abused. A spike in hosts and bytes during off-hours probably means a stolen credential. Cross-check with the FTP account list and rotate passwords.
  • You’re comparing month-over-month upload volume. The KBytes graph is the easiest place to see this.
If you only use FTP for your own deploys, the report is going to look sparse and there’s nothing wrong with that.

​
When the report is empty

  • FTP service is disabled on your plan or your account.
  • You haven’t connected over FTP in the report period.
  • You only use SFTP (which is logged elsewhere, since it goes through SSH, not the FTP daemon).
The last point catches people out. SFTP traffic doesn’t appear here. SFTP is a feature of SSH and uses port 22; FTP and FTPS use port 21. Webalizer FTP only sees traffic that actually hits the FTP daemon.

​
Common issues

Expected. SFTP runs over SSH, and SSH activity isn’t reported by Webalizer at all. For SFTP audit data, check your SSH access log via Raw Access or open a ticket.
The Webalizer FTP run is daily, but only fires if there’s new log data. A completely idle FTP account skips runs and the report stays frozen on the last activity.
Someone with FTP credentials uploaded it. Check the FTP account list (FTP Accounts) and recent passwords. If the file is suspicious, delete it, rotate every FTP password, and open a ticket.

​
Need a hand?