Important changes to logging for users upgrading to Cerberus FTP Server Version 11

Cerberus version 11 introduces important changes to logging.

In Cerberus FTP server 11, every log statement that originates from a client connection includes an IP address and username. To take advantage of this new logging feature, existing users of Cerberus must update your log4j.xml configuration file after updating to version 11.  You will need to modify these files in order to ensure the username and IP address is added to each client log statement in your log files. 

What is the log4j.xml file? 

These are the main configuration files that contain all the information for Cerberus to use logging. 

Where can I find these configuration files?

The log4j.xml is located in C:\ProgramData\Cerberus LLC\Cerberus FTP Server\

What do I need to modify? 

Once you have found and opened the log4j.xml file in the file editor of your choice, you will need to replace the following line (note: depending on your configuration, there could be multiple lines): 

<param name="ConversionPattern" value="[%d{yyyy-MM-dd HH:mm:ss}]:%7.7p [%6.6x] - %m%n" />

With 

<param name="ConversionPattern" value="[%d{yyyy-MM-dd HH:mm:ss}]:%7.7p [%6.6x] - [%X{client.ip}]:%X{client.user} - %m%n" />

After you have saved your changes, you will want to restart the Cerberus FTP Server Service in the Windows System Manager. 

You will now see in every log statement that originates from a client connection has a username and an IP address.

 Example: 

[2019-11-18 10:53:11]:   INFO [1994] - [127.0.0.1]:dana - File upload started……

 What will happen if I don’t modify my log4j.xml file? 

Cerberus will continue to log all file and user operations, and key events like connection establishment or successful authentication will still contain IP and user info. However, other events in the log will not contain username and IP information. 

Note: For new 11.0 installations, this feature is enabled and available automatically for on-screen and the default file-based logging. 

In the previous example, %X{client.ip} and %X{client.user} are custom parameters for the PatternLayout to include the IP address and username, respectively.  You can also include the session ID with the custom parameter %X{client.session}.  Similar to the IP address and the username, including the session ID provides more information that makes it easier to follow what is happening in the logs.