API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Feb 11th, 2019
1,335
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 393.88 KB | None | 0 0
raw download clone embed print report
  1. <?xml version="1.0" encoding="UTF-8" ?>
  2. <log>
  3. <start time="2019-02-11 08:06:33.729561 -0700" appName="BvSshServer" appVersion="8.24" thisFile="C:\Program Files\Bitvise SSH Server\Logs\BvSshServer20190211-080633728-M0700.log"/>
  4.  
  5. <event seq="1" time="2019-02-11 08:06:33.726409 -0700" app="BvSshServer 8.24" name="I_SERVICE_CONFIG_DESCRIPTION" desc="Configuration description.">
  6. <parameters configPart="ServerSettings"/>
  7. <change time="2019-02-08 16:37:02.727378 -0700" action="Settings edited via local Easy Settings interface by 'domain.local\MyUsername'." process="BssCtrl.exe"/>
  8. <change time="2019-02-08 11:02:05.421350 -0700" action="Settings edited via local Advanced Settings interface by 'domain.local\MyUsername'." process="BssCtrl.exe"/>
  9. <change time="2019-02-08 10:53:55.956038 -0700" action="Settings edited via local Advanced Settings interface by 'domain.local\MyUsername'." process="BssCtrl.exe"/>
  10. <change time="2019-02-08 10:38:35.590013 -0700" action="Settings edited via local Easy Settings interface by 'domain.local\MyUsername'." process="BssCtrl.exe"/>
  11. <change time="2019-02-08 10:38:09.281807 -0700" action="Settings edited via local Easy Settings interface by 'domain.local\MyUsername'." process="BssCtrl.exe"/>
  12. <settings fullSettingsLogReason="Startup">
  13. <powerShell><![CDATA[
  14. $cfg = new-object -com "BssCfg815.BssCfg815"
  15.  
  16. $cfg.settings.SetDefaults()
  17. $cfg.settings.server.SetDefaults()
  18. $cfg.settings.server.bindings.SetDefaults()
  19. $cfg.settings.server.bindings.ipv4.Clear()
  20. $cfg.settings.server.bindings.ipv4.new.SetDefaults()
  21. $cfg.settings.server.bindings.ipv4.new.serviceType = 1 # $cfg.enums.ServiceType.ftp
  22. $cfg.settings.server.bindings.ipv4.new.port = 21
  23. $cfg.settings.server.bindings.ipv4.NewCommit()
  24. $cfg.settings.server.bindings.ipv4.new.SetDefaults()
  25. $cfg.settings.server.bindings.ipv4.new.port = 22
  26. $cfg.settings.server.bindings.ipv4.NewCommit()
  27. $cfg.settings.server.bindings.ipv6.Clear()
  28. $cfg.settings.server.windowsFirewall.SetDefaults()
  29. $cfg.settings.server.windowsFirewall.sshPortsFirewallSetting = 3 # $cfg.enums.WindowsFirewallSetting.globalScope
  30. $cfg.settings.server.windowsFirewall.forwardedPortsFirewallSetting = 3 # $cfg.enums.WindowsFirewallSetting.globalScope
  31. $cfg.settings.server.windowsFirewall.ftpPortsFirewallSetting = 3 # $cfg.enums.WindowsFirewallSetting.globalScope
  32. $cfg.settings.server.logging.SetDefaults()
  33. $cfg.settings.server.logging.logFileLevel = 3 # $cfg.enums.LogLevel_EWIT.logLevelEWIT
  34. $cfg.settings.server.debugging.SetDefaults()
  35. $cfg.settings.server.debugging.enableInWindowDebugMode = $true
  36. $cfg.settings.access.SetDefaults()
  37. $cfg.settings.access.passwordMethod = 3 # $cfg.enums.GlobalAuthMethod.permitVirtAccounts
  38. $cfg.settings.access.kbdiPasswordMethod = 3 # $cfg.enums.GlobalAuthMethod.permitVirtAccounts
  39. $cfg.settings.access.virtAccounts.Clear()
  40. $cfg.settings.access.virtAccounts.new.SetDefaults()
  41. $cfg.settings.access.virtAccounts.new.virtAccount = "testuser"
  42. $cfg.settings.access.virtAccounts.new.virtPassword.crypt = 38725JLKSDRGLJKEASRTOIJ258723JLKERGAERG"
  43. $cfg.settings.access.virtAccounts.new.group = "Virtual Users"
  44. $cfg.settings.access.virtAccounts.new.loginAllowed = 1 # $cfg.enums.DefaultYesNo.yes
  45. $cfg.settings.access.virtAccounts.new.term.SetDefaults()
  46. $cfg.settings.access.virtAccounts.new.term.shellAccessType = 2 # $cfg.enums.ShellAccessWD.disabled
  47. $cfg.settings.access.virtAccounts.new.xfer.SetDefaults()
  48. $cfg.settings.access.virtAccounts.new.xfer.permitScp = 1 # $cfg.enums.DefaultYesNo.yes
  49. $cfg.settings.access.virtAccounts.new.xfer.permitSftp = 1 # $cfg.enums.DefaultYesNo.yes
  50. $cfg.settings.access.virtAccounts.new.xfer.permitFtps = 1 # $cfg.enums.DefaultYesNo.yes
  51. $cfg.settings.access.virtAccounts.new.xfer.inheritMountPoints = $false
  52. $cfg.settings.access.virtAccounts.new.xfer.mountPoints.Clear()
  53. $cfg.settings.access.virtAccounts.new.xfer.mountPoints.new.SetDefaults()
  54. $cfg.settings.access.virtAccounts.new.xfer.mountPoints.new.realRootPath = "C:\Share"
  55. $cfg.settings.access.virtAccounts.new.xfer.mountPoints.new.deleteExistAccess = $false
  56. $cfg.settings.access.virtAccounts.new.xfer.mountPoints.new.fileSharing = 3 # $cfg.enums.SfsProviderFileShare.readWrite
  57. $cfg.settings.access.virtAccounts.new.xfer.mountPoints.NewCommit()
  58. $cfg.settings.access.virtAccounts.new.xfer.useDefaultSfsHomeDir = $false
  59. $cfg.settings.access.virtAccounts.new.fwding.SetDefaults()
  60. $cfg.settings.access.virtAccounts.new.fwding.permitC2S = 2 # $cfg.enums.DefaultYesNo.no
  61. $cfg.settings.access.virtAccounts.new.fwding.permitS2C = 2 # $cfg.enums.DefaultYesNo.no
  62. $cfg.settings.access.virtAccounts.NewCommit()
  63.  
  64. $cfg.settings.Save()
  65. ]]></powerShell>
  66. </settings>
  67. </event>
  68.  
  69. <event seq="2" time="2019-02-11 08:06:33.729756 -0700" app="BvSshServer 8.24" name="I_SERVICE_CONFIG_DESCRIPTION" desc="Configuration description.">
  70. <parameters configPart="HostKeys" keypairCount="2"/>
  71. <keypair algorithm="RSA" keyBits="3072" md5="a1:11:22:ca:b3:4c:e3:dc:0a:ba:2c:b3:2e:b0:9d:cf" babble="xucef-test-bovit-hibor-tutub-lenup-lyduh-buvef-lonuz-huruk-rixix" sha256="hpaQeIoLrKykeZWQuY6NBbLhk6bYpW9+Xx9DkZho"/>
  72. <keypair algorithm="ECDSA/nistp384" keyBits="384" md5="6b:6f:af:06:c5:29:f4:4d:fd:4d:41:19:d2:e0:dc:7a" babble="xunez-gebur-nanem-vuvig-gohyb-mapef-vycig-sikeh-tobom-muvog-kaxex" sha256="hpaQeIoLrKykeZWQuY6NBbLhk6bYpW9+X2ngjVA0I"/>
  73. </event>
  74.  
  75. <event seq="3" time="2019-02-11 08:06:33.729799 -0700" app="BvSshServer 8.24" name="I_SERVICE_CONFIG_DESCRIPTION" desc="Configuration description.">
  76. <parameters configPart="Certificates" certificateCount="1"/>
  77. <certificate issuedTo="Bitvise SSH Server" issuedBy="Bitvise SSH Server" serial="12:5d:46:14:87:bc:a4:a1:48:57:87:b8:b7:9c:4e:2d"/>
  78. </event>
  79.  
  80. <event seq="4" time="2019-02-11 08:06:33.735183 -0700" app="BvSshServer 8.24" name="T_STATS_FILE_READ_COMPLETED" desc="Reading stats file completed.">
  81. <parameters statsType="ServerTotal" account="ServerTotal" file="BssStats-nbst-ServerTotal-00.xml"/>
  82. </event>
  83.  
  84. <event seq="5" time="2019-02-11 08:06:33.745045 -0700" app="BvSshServer 8.24" name="T_SERVICE_TOTERM_INIT_SUCCEEDED" desc="Terminal server initialization succeeded.">
  85. <parameters path="C:\Program Files\Bitvise SSH Server"/>
  86. </event>
  87.  
  88. <event seq="6" time="2019-02-11 08:06:33.745307 -0700" app="BvSshServer 8.24" name="I_UPDATE_MANAGER_VERSION_STATUS" desc="SSH Server version status." versionStatus="Current">
  89. <help message="This is the latest release. Updates may become available on any channel."/>
  90. </event>
  91.  
  92. <event seq="7" time="2019-02-11 08:06:33.759333 -0700" app="BvSshServer 8.24" name="I_AUTO_ACCOUNT_ENABLED" desc="Enabled the automatically managed local account for virtual users.">
  93. <parameters account="BvSsh_VirtualUsers"/>
  94. </event>
  95.  
  96. <event seq="8" time="2019-02-11 08:06:33.770159 -0700" app="BvSshServer 8.24" name="T_AUTO_ACCOUNT_PASSWORD_CHANGED" desc="Changed password for the automatically managed local account for virtual users.">
  97. <parameters account="BvSsh_VirtualUsers"/>
  98. </event>
  99.  
  100. <event seq="9" time="2019-02-11 08:06:33.795569 -0700" app="BvSshServer 8.24" name="E_SERVICE_SOCKET_BIND_ERROR" desc="Error binding listening socket.">
  101. <parameters listenAddress="0.0.0.0:21" service="FTP"/>
  102. <error type="WinApi" operation="bind() in ListeningSocket::StartListening()" code="10048" message="Only one usage of each socket address (protocol/network address/port) is normally permitted."/>
  103. <help
  104. message="This indicates that another service on this machine may be listening on the same port. Configure either Bitvise SSH Server or the other service to listen on a different port, or deactivate or uninstall the conflicting service."/>
  105. </event>
  106.  
  107. <event seq="10" time="2019-02-11 08:06:33.796569 -0700" app="BvSshServer 8.24" name="I_SERVICE_SOCKET_BOUND" desc="Listening socket bound.">
  108. <parameters listenAddress="0.0.0.0:22" service="SSH" proxyProtocol="Disabled"/>
  109. </event>
  110.  
  111. <event seq="11" time="2019-02-11 08:06:33.916925 -0700" app="BvSshServer 8.24" name="I_FIREWALL_EXCEPTION_ADDED" desc="Windows Firewall exception added.">
  112. <parameters port="22" scope="Global" type="TCP/IPv4"/>
  113. </event>
  114.  
  115. <event seq="12" time="2019-02-11 08:06:33.918031 -0700" app="BvSshServer 8.24" name="I_SERVICE_CONF_SYNC_SETTINGS_DESCRIPTION" desc="Description of synchronization settings.">
  116. <settings>
  117. <powerShell><![CDATA[
  118. $cfg = new-object -com "BssCfg815.BssCfg815"
  119.  
  120. $cfg.instance.SetDefaults()
  121.  
  122. $cfg.instance.Save()
  123. ]]></powerShell>
  124. </settings>
  125. </event>
  126.  
  127. <event seq="13" time="2019-02-11 08:06:33.918366 -0700" app="BvSshServer 8.24" name="I_SERVICE_CONF_SYNC_SETTINGS_APPLIED" desc="Synchronization settings successfully applied."/>
  128.  
  129. <event seq="14" time="2019-02-11 08:06:33.920235 -0700" app="BvSshServer 8.24" name="I_SERVICE_STARTED" desc="Service started.">
  130. <parameters serviceAccount="NT AUTHORITY\SYSTEM" sessionId="0" processId="1452" exePath="C:\Program Files\Bitvise SSH Server\BvSshServer.exe" cryptoProvider="Windows CNG (x64) with additions" bootTime="2019-02-11 08:06:33 -0700" computerName="FTPTEST" computerSid="S-1-5-21-2595271796-1503587317-2003292510" computerDomainName="mydomain" computerDnsDomainName="mydomain.local" windowsVersion="6.1.7601 (64-bit)" servicePack="1" isDomainController="false" lsaProtection="0" lsaAuthPackages="msv1_0; BvLsaEx" bvLsaFileSize="343456" bvLsaLastInitTime="2019-02-11 08:06:32 -0700" bvLsaVersion="20.2.0.0" bvAllocHook="false" bvAllocHeapCount="8"/>
  131. </event>
  132.  
  133. <event seq="15" time="2019-02-11 08:09:33.633793 -0700" app="BvSshServer 8.24" name="I_SERVICE_SOCKET_BOUND" desc="Listening socket bound.">
  134. <parameters listenAddress="0.0.0.0:21" service="FTP" proxyProtocol="Disabled"/>
  135. </event>
  136.  
  137. <event seq="16" time="2019-02-11 08:09:33.633863 -0700" app="BvSshServer 8.24" name="I_SERVICE_SOCKET_BOUND" desc="Listening socket bound.">
  138. <parameters listenAddress="0.0.0.0:49225" service="FTP" serviceAddress="0.0.0.0:21"/>
  139. </event>
  140.  
  141. <event seq="17" time="2019-02-11 08:09:33.667938 -0700" app="BvSshServer 8.24" name="I_FIREWALL_EXCEPTION_ADDED" desc="Windows Firewall exception added.">
  142. <parameters port="21" scope="Global" type="TCP/IPv4"/>
  143. </event>
  144.  
  145. <event seq="18" time="2019-02-11 08:09:33.792049 -0700" app="BvSshServer 8.24" name="I_FIREWALL_EXCEPTION_ADDED" desc="Windows Firewall exception added.">
  146. <parameters port="49225" scope="Global" type="TCP/IPv4"/>
  147. </event>
  148.  
  149. <event seq="19" time="2019-02-11 08:09:40.915218 -0700" app="BvSshServer 8.24" name="I_CONNECT_ACCEPTED" desc="Connection accepted.">
  150. <session id="1001" service="FTP" remoteAddress="8.8.8.8:51282" loc="CA/NA"/>
  151. <location continent="North America" country="Canada"/>
  152. <parameters addressRule="AnyIP" listenAddress="192.168.0.2:21"/>
  153. <sessions ssh="0" sshAuth="0" ftp="1" ftpAuth="0"/>
  154. </event>
  155.  
  156. <event seq="20" time="2019-02-11 08:09:40.919405 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  157. <session id="1001" service="FTP" remoteAddress="8.8.8.8:51282" loc="CA/NA"/>
  158. <parameters reply="220 Bitvise SSH Server 8.24"/>
  159. </event>
  160.  
  161. <event seq="21" time="2019-02-11 08:09:40.919755 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  162. <session id="1001" service="FTP" remoteAddress="8.8.8.8:51282" loc="CA/NA"/>
  163. <parameters command="????l???h??�r��P\D�?J��$R?�?`??Qb%�b�������??:????????�,̩�"/>
  164. </event>
  165.  
  166. <event seq="22" time="2019-02-11 08:09:40.919807 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  167. <session id="1001" service="FTP" remoteAddress="8.8.8.8:51282" loc="CA/NA"/>
  168. <parameters reply="500 Unrecognized command"/>
  169. </event>
  170.  
  171. <event seq="23" time="2019-02-11 08:09:40.919826 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  172. <session id="1001" service="FTP" remoteAddress="8.8.8.8:51282" loc="CA/NA"/>
  173. <parameters command="���+� ���0̨�?�/�??�?5��?�?/��?�̪?9��?�?3��??????????????"/>
  174. </event>
  175.  
  176. <event seq="24" time="2019-02-11 08:09:40.919849 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  177. <session id="1001" service="FTP" remoteAddress="8.8.8.8:51282" loc="CA/NA"/>
  178. <parameters reply="500 Unrecognized command"/>
  179. </event>
  180.  
  181. <event seq="25" time="2019-02-11 08:09:40.919862 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  182. <session id="1001" service="FTP" remoteAddress="8.8.8.8:51282" loc="CA/NA"/>
  183. <parameters command="??????????????????????????????? ?????"/>
  184. </event>
  185.  
  186. <event seq="26" time="2019-02-11 08:09:40.919890 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  187. <session id="1001" service="FTP" remoteAddress="8.8.8.8:51282" loc="CA/NA"/>
  188. <parameters reply="500 Unrecognized command"/>
  189. </event>
  190.  
  191. <event seq="27" time="2019-02-11 08:09:40.937930 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  192. <session id="1001" service="FTP" remoteAddress="8.8.8.8:51282" loc="CA/NA"/>
  193. <parameters reply="421 Internal server error; see server's logs for details"/>
  194. </event>
  195.  
  196. <event seq="28" time="2019-02-11 08:09:41.911108 -0700" app="BvSshServer 8.24" name="I_SESSION_DISCONNECTED_NORMALLY" desc="Session disconnected normally.">
  197. <session id="1001" service="FTP" remoteAddress="8.8.8.8:51282" loc="CA/NA"/>
  198. <parameters disconnectReason="Socket" socketBytesReceived="369" socketBytesSent="165" payloadBytesReceived="0" payloadBytesSent="0"/>
  199. <error type="Flow" component="FtpManager/socketReader" class="WinApi" code="10054" message="An existing connection was forcibly closed by the remote host." description="FlowSocketReader: Error receiving bytes"/>
  200. </event>
  201.  
  202. <event seq="29" time="2019-02-11 08:09:43.894484 -0700" app="BvSshServer 8.24" name="I_CONNECT_ACCEPTED" desc="Connection accepted.">
  203. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA"/>
  204. <location continent="North America" country="Canada"/>
  205. <parameters addressRule="AnyIP" listenAddress="192.168.0.2:22"/>
  206. <sessions ssh="1" sshAuth="0" ftp="0" ftpAuth="0"/>
  207. </event>
  208.  
  209. <event seq="30" time="2019-02-11 08:09:43.904406 -0700" app="BvSshServer 8.24" name="I_CONNECT_VERSION_RECEIVED" desc="Client version string received.">
  210. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA"/>
  211. <parameters clientVersion="SSH-2.0-FileZilla_3.40.0"/>
  212. </event>
  213.  
  214. <event seq="31" time="2019-02-11 08:09:43.904459 -0700" app="BvSshServer 8.24" name="T_CONNECT_CLIENTVERSIONRULE" desc="The client version rule effective for this connection.">
  215. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA"/>
  216. <versionRule matchAll="true" accept="true" allowPasswordAuth="true" allowPwKbdiAuth="true" allowGssApiAuth="true" sshUserMustMatchGssApi="true"/>
  217. </event>
  218.  
  219. <event seq="32" time="2019-02-11 08:09:43.904655 -0700" app="BvSshServer 8.24" name="T_SESSION_KEY_EXCHANGE_EVENT" desc="Key exchange event.">
  220. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA"/>
  221. <parameters eventType="Start" kexTriggerType="First" kexNr="1"/>
  222. </event>
  223.  
  224. <event seq="33" time="2019-02-11 08:09:43.928538 -0700" app="BvSshServer 8.24" name="T_SESSION_KEY_EXCHANGE_EVENT" desc="Key exchange event.">
  225. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA"/>
  226. <parameters eventType="OutDone" kexTriggerType="First" kexNr="1"/>
  227. </event>
  228.  
  229. <event seq="34" time="2019-02-11 08:09:43.957923 -0700" app="BvSshServer 8.24" name="T_SESSION_KEY_EXCHANGE_EVENT" desc="Key exchange event.">
  230. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA"/>
  231. <parameters eventType="InDone" kexTriggerType="First" kexNr="1"/>
  232. </event>
  233.  
  234. <event seq="35" time="2019-02-11 08:09:43.957958 -0700" app="BvSshServer 8.24" name="I_SESSION_KEY_EXCHANGE_ALGORITHMS" desc="Key exchange algorithms.">
  235. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA"/>
  236. <parameters kexAlg="Curve25519@libssh" cipherAlgIn="aes256-gcm" cipherAlgOut="aes256-gcm" macAlgIn="" macAlgOut="" comprAlgIn="none" comprAlgOut="none"/>
  237. </event>
  238.  
  239. <event seq="36" time="2019-02-11 08:09:43.973406 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_ATTEMPT_STARTED" desc="User authentication attempt started.">
  240. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA"/>
  241. <authentication attemptNr="1" userName="testuser" method="none"/>
  242. </event>
  243.  
  244. <event seq="37" time="2019-02-11 08:09:43.974221 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_NONE" desc="The client used the 'none' authentication method. This is used to query available authentication methods.">
  245. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA"/>
  246. <authentication attemptNr="1" userName="testuser" method="none"/>
  247. </event>
  248.  
  249. <event seq="38" time="2019-02-11 08:09:43.974286 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_ATTEMPT_ENDED" desc="User authentication attempt ended.">
  250. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA"/>
  251. <authentication attemptNr="1" userName="testuser" method="none"/>
  252. </event>
  253.  
  254. <event seq="39" time="2019-02-11 08:09:43.988934 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_ATTEMPT_STARTED" desc="User authentication attempt started.">
  255. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA"/>
  256. <authentication attemptNr="1" userName="testuser" method="keyboard-interactive" submethod="None"/>
  257. </event>
  258.  
  259. <event seq="40" time="2019-02-11 08:09:43.21092 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_KBDI_INFO_REQUEST_SENT" desc="Requested information for keyboard-interactive authentication.">
  260. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA"/>
  261. <authentication attemptNr="1" serialize="completion" userName="testuser" method="keyboard-interactive" submethod="Password"/>
  262. <parameters name="Password authentication" instruction="" promptCount="1"/>
  263. </event>
  264.  
  265. <event seq="41" time="2019-02-11 08:09:44.005637 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_KBDI_INFO_RESPONSE_RECEIVED" desc="Received information response for keyboard-interactive authentication.">
  266. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA"/>
  267. <authentication attemptNr="1" serialize="completion" userName="testuser" method="keyboard-interactive" submethod="Password" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  268. <parameters responseCount="1"/>
  269. </event>
  270.  
  271. <event seq="42" time="2019-02-11 08:09:44.036537 -0700" app="BvSshServer 8.24" name="T_LOGON_PROCEDURE_TIMING" desc="Logon procedure timing.">
  272. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA"/>
  273. <parameters procedure="LogonUser()" timerMs="2"/>
  274. </event>
  275.  
  276. <event seq="43" time="2019-02-11 08:09:44.036589 -0700" app="BvSshServer 8.24" name="T_LOGON_TOKEN_ELEVATION_CHANGE_FAILED" desc="Could not change or obtain user token elevation state.">
  277. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA"/>
  278. <parameters desiredElevation="Yes" failureReason="LinkedTokenNotAvailable"/>
  279. <help message="Elevation state cannot be changed for sessions with the 'network' logon type."/>
  280. </event>
  281.  
  282. <event seq="44" time="2019-02-11 08:09:44.041718 -0700" app="BvSshServer 8.24" name="T_LOGON_PROCEDURE_TIMING" desc="Logon procedure timing.">
  283. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA"/>
  284. <parameters procedure="NetUserGetInfo()" timerMs="4"/>
  285. </event>
  286.  
  287. <event seq="45" time="2019-02-11 08:09:44.043171 -0700" app="BvSshServer 8.24" name="I_LOGON_AUTH_SUCCEEDED" desc="User authentication succeeded.">
  288. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  289. <authentication attemptNr="1" serialize="completion" userName="testuser" method="keyboard-interactive" submethod="Password"/>
  290. <parameters accountSettings="testuser" groupSettings="Virtual Users" tokenType="LogonUser" tokenLogonType="Network" tokenElevation="Restricted"/>
  291. </event>
  292.  
  293. <event seq="46" time="2019-02-11 08:09:44.043362 -0700" app="BvSshServer 8.24" name="T_LOGON_HOME_DIRECTORY_RETRIEVE_ERROR" desc="Error retrieving home directory.">
  294. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  295. <error type="WinApi" operation="GetUserProfileDirectory()" code="2" message="The system cannot find the file specified."/>
  296. </event>
  297.  
  298. <event seq="47" time="2019-02-11 08:09:44.044434 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_ATTEMPT_ENDED" desc="User authentication attempt ended.">
  299. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  300. <authentication attemptNr="1" serialize="completion" userName="testuser" method="keyboard-interactive" submethod="Password"/>
  301. </event>
  302.  
  303. <event seq="48" time="2019-02-11 08:09:44.044665 -0700" app="BvSshServer 8.24" name="T_SESSION_EXTENSIONS" desc="State of session extensions.">
  304. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  305. <parameters noFlowControl="disabled"/>
  306. </event>
  307.  
  308. <event seq="49" time="2019-02-11 08:09:44.045365 -0700" app="BvSshServer 8.24" name="T_STATS_FILE_READ_COMPLETED" desc="Reading stats file completed.">
  309. <parameters statsType="VirtGroup" virtualGroup="Virtual Users" file="BssStats-nbvg-Virtual Users-00.xml"/>
  310. </event>
  311.  
  312. <event seq="50" time="2019-02-11 08:09:44.046085 -0700" app="BvSshServer 8.24" name="T_STATS_FILE_READ_COMPLETED" desc="Reading stats file completed.">
  313. <parameters statsType="VirtAccount" virtualAccount="testuser" file="BssStats-nbva-testuser-00.xml"/>
  314. </event>
  315.  
  316. <event seq="51" time="2019-02-11 08:09:44.060111 -0700" app="BvSshServer 8.24" name="I_CHANNEL_SESSION_OPENED" desc="Session channel opened.">
  317. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  318. <channel type="session" id="1"/>
  319. </event>
  320.  
  321. <event seq="52" time="2019-02-11 08:09:44.084790 -0700" app="BvSshServer 8.24" name="T_SUBSYS_EXECUTED" desc="SSH server subsystem executed.">
  322. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  323. <channel type="session" id="1"/>
  324. <parameters exeFile="SfsServer.exe"/>
  325. </event>
  326.  
  327. <event seq="53" time="2019-02-11 08:09:44.139011 -0700" app="BvSshServer 8.24" name="I_SFTP_SERVER_VERSION_NEGOTIATED" desc="SFTP protocol version negotiated.">
  328. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  329. <channel type="session" id="1"/>
  330. <parameters versionRequested="3" versionSelected="3"/>
  331. </event>
  332.  
  333. <event seq="54" time="2019-02-11 08:09:44.139157 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  334. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  335. <channel type="session" id="1"/>
  336. <sfs moduleName="FlowSfsRoot" code="11901" desc="Initializing module with the following settings.">
  337. <parameters
  338. settings="Root
  339. HomePath=/
  340. CreateHome=No
  341. ShowRelative=Yes
  342. DelayInit=Yes
  343. Provider=FlowSfsWin
  344. MountPath=/
  345. MountMode=List,ReadExist,WriteExist,ReadWriteDeleteNew,CreateDir,CreateLink
  346. RootPath=C:\Share
  347. CreateRoot=No
  348. MaxPathLength=3000
  349. DelayInit=Yes
  350. ShowEmptyDir=IfNoAccess
  351. FileShareBeh=Default
  352. FileShare=Read,Write
  353. OwnerGroup=IfUnknown-Default
  354. Acl=IfUnknownAce-DefaultAcl"/>
  355. </sfs>
  356. </event>
  357.  
  358. <event seq="55" time="2019-02-11 08:09:44.139188 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  359. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  360. <channel type="session" id="1"/>
  361. <sfs moduleName="FlowSfsRoot" code="11000" desc="Initializing module succeeded."/>
  362. </event>
  363.  
  364. <event seq="56" time="2019-02-11 08:09:44.157251 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  365. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  366. <channel type="session" id="1"/>
  367. <sfs moduleName="FlowSfsRoot" code="31904" desc="Paths processed.">
  368. <parameters pathRaw="." path="/"/>
  369. <handler moduleName="FlowSfsWin" mountPath="/"/>
  370. </sfs>
  371. </event>
  372.  
  373. <event seq="57" time="2019-02-11 08:09:44.157286 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  374. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  375. <channel type="session" id="1"/>
  376. <sfs moduleName="FlowSfsWin" mountPath="/" code="11000" desc="Initializing module succeeded."/>
  377. </event>
  378.  
  379. <event seq="58" time="2019-02-11 08:09:44.158113 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  380. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  381. <channel type="session" id="1"/>
  382. <sfs moduleName="FlowSfsWin" mountPath="/" code="31000" desc="Querying real path succeeded.">
  383. <parameters path="C:\Share" controlByte="NoCheck"/>
  384. </sfs>
  385. </event>
  386.  
  387. <event seq="59" time="2019-02-11 08:09:44.174290 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  388. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  389. <channel type="session" id="1"/>
  390. <sfs moduleName="FlowSfsRoot" code="31904" desc="Paths processed.">
  391. <parameters pathRaw="/." path="/"/>
  392. <handler moduleName="FlowSfsWin" mountPath="/"/>
  393. </sfs>
  394. </event>
  395.  
  396. <event seq="60" time="2019-02-11 08:09:44.174321 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  397. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  398. <channel type="session" id="1"/>
  399. <sfs moduleName="FlowSfsWin" mountPath="/" code="31000" desc="Querying real path succeeded.">
  400. <parameters path="C:\Share" controlByte="NoCheck"/>
  401. </sfs>
  402. </event>
  403.  
  404. <event seq="61" time="2019-02-11 08:09:44.189941 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  405. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  406. <channel type="session" id="1"/>
  407. <sfs moduleName="FlowSfsRoot" code="26904" desc="Paths processed.">
  408. <parameters pathRaw="/" path="/"/>
  409. <handler moduleName="FlowSfsWin" mountPath="/"/>
  410. </sfs>
  411. </event>
  412.  
  413. <event seq="62" time="2019-02-11 08:09:44.190018 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  414. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  415. <channel type="session" id="1"/>
  416. <sfs moduleName="FlowSfsWin" mountPath="/" code="26000" desc="Opening directory succeeded.">
  417. <parameters path="C:\Share"/>
  418. </sfs>
  419. </event>
  420.  
  421. <event seq="63" time="2019-02-11 08:09:44.213535 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  422. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  423. <channel type="session" id="1"/>
  424. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  425. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  426. </sfs>
  427. </event>
  428.  
  429. <event seq="64" time="2019-02-11 08:09:44.213574 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  430. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  431. <channel type="session" id="1"/>
  432. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  433. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  434. </sfs>
  435. </event>
  436.  
  437. <event seq="65" time="2019-02-11 08:09:44.219682 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  438. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  439. <channel type="session" id="1"/>
  440. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  441. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  442. </sfs>
  443. </event>
  444.  
  445. <event seq="66" time="2019-02-11 08:09:44.219713 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  446. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  447. <channel type="session" id="1"/>
  448. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  449. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  450. </sfs>
  451. </event>
  452.  
  453. <event seq="67" time="2019-02-11 08:09:44.248930 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  454. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  455. <channel type="session" id="1"/>
  456. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  457. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  458. </sfs>
  459. </event>
  460.  
  461. <event seq="68" time="2019-02-11 08:09:44.264646 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  462. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  463. <channel type="session" id="1"/>
  464. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  465. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  466. </sfs>
  467. </event>
  468.  
  469. <event seq="69" time="2019-02-11 08:09:44.271007 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  470. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  471. <channel type="session" id="1"/>
  472. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  473. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  474. </sfs>
  475. </event>
  476.  
  477. <event seq="70" time="2019-02-11 08:09:44.271047 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  478. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  479. <channel type="session" id="1"/>
  480. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  481. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  482. </sfs>
  483. </event>
  484.  
  485. <event seq="71" time="2019-02-11 08:09:44.272022 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  486. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  487. <channel type="session" id="1"/>
  488. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  489. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  490. </sfs>
  491. </event>
  492.  
  493. <event seq="72" time="2019-02-11 08:09:44.281933 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  494. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  495. <channel type="session" id="1"/>
  496. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  497. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  498. </sfs>
  499. </event>
  500.  
  501. <event seq="73" time="2019-02-11 08:09:44.288101 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  502. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  503. <channel type="session" id="1"/>
  504. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  505. <parameters path="C:\Share" entriesCount="11" reachedEof="true"/>
  506. </sfs>
  507. </event>
  508.  
  509. <event seq="74" time="2019-02-11 08:09:44.290176 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  510. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  511. <channel type="session" id="1"/>
  512. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  513. <parameters path="C:\Share" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  514. </sfs>
  515. </event>
  516.  
  517. <event seq="75" time="2019-02-11 08:09:44.290213 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  518. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  519. <channel type="session" id="1"/>
  520. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  521. <parameters path="C:\Share" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  522. </sfs>
  523. </event>
  524.  
  525. <event seq="76" time="2019-02-11 08:09:44.298255 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  526. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  527. <channel type="session" id="1"/>
  528. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  529. <parameters path="C:\Share" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  530. </sfs>
  531. </event>
  532.  
  533. <event seq="77" time="2019-02-11 08:09:44.303325 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  534. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  535. <channel type="session" id="1"/>
  536. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  537. <parameters path="C:\Share" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  538. </sfs>
  539. </event>
  540.  
  541. <event seq="78" time="2019-02-11 08:09:44.318471 -0700" app="BvSshServer 8.24" name="I_SFS_LIST_DIRECTORY" desc="Virtual filesystem: list directory.">
  542. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  543. <channel type="session" id="1"/>
  544. <sfs moduleName="FlowSfsWin" mountPath="/" code="91000" desc="Listing directory ended.">
  545. <parameters path="C:\Share" timeMs="128" entriesCount="511"/>
  546. </sfs>
  547. </event>
  548.  
  549. <event seq="79" time="2019-02-11 08:09:44.318508 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  550. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  551. <channel type="session" id="1"/>
  552. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  553. <parameters path="C:\Share" type="Directory"/>
  554. </sfs>
  555. </event>
  556.  
  557. <event seq="80" time="2019-02-11 08:09:45.850344 -0700" app="BvSshServer 8.24" name="I_CONNECT_ACCEPTED" desc="Connection accepted.">
  558. <session id="1003" service="FTP" remoteAddress="8.8.8.8:51284" loc="CA/NA"/>
  559. <location continent="North America" country="Canada"/>
  560. <parameters addressRule="AnyIP" listenAddress="192.168.0.2:21"/>
  561. <sessions ssh="1" sshAuth="1" ftp="1" ftpAuth="0"/>
  562. </event>
  563.  
  564. <event seq="81" time="2019-02-11 08:09:45.850737 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  565. <session id="1003" service="FTP" remoteAddress="8.8.8.8:51284" loc="CA/NA"/>
  566. <parameters reply="220 Bitvise SSH Server 8.24"/>
  567. </event>
  568.  
  569. <event seq="82" time="2019-02-11 08:09:45.850829 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  570. <session id="1003" service="FTP" remoteAddress="8.8.8.8:51284" loc="CA/NA"/>
  571. <parameters command="????l???h??�*`��?oJq��h�m��62\���?��W&amp;?�J??:????????�,̩�"/>
  572. </event>
  573.  
  574. <event seq="83" time="2019-02-11 08:09:45.850858 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  575. <session id="1003" service="FTP" remoteAddress="8.8.8.8:51284" loc="CA/NA"/>
  576. <parameters reply="500 Unrecognized command"/>
  577. </event>
  578.  
  579. <event seq="84" time="2019-02-11 08:09:45.850874 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  580. <session id="1003" service="FTP" remoteAddress="8.8.8.8:51284" loc="CA/NA"/>
  581. <parameters command="���+� ���0̨�?�/�??�?5��?�?/��?�̪?9��?�?3��??????????????"/>
  582. </event>
  583.  
  584. <event seq="85" time="2019-02-11 08:09:45.850890 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  585. <session id="1003" service="FTP" remoteAddress="8.8.8.8:51284" loc="CA/NA"/>
  586. <parameters reply="500 Unrecognized command"/>
  587. </event>
  588.  
  589. <event seq="86" time="2019-02-11 08:09:45.850902 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  590. <session id="1003" service="FTP" remoteAddress="8.8.8.8:51284" loc="CA/NA"/>
  591. <parameters command="??????????????????????????????? ?????"/>
  592. </event>
  593.  
  594. <event seq="87" time="2019-02-11 08:09:45.850917 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  595. <session id="1003" service="FTP" remoteAddress="8.8.8.8:51284" loc="CA/NA"/>
  596. <parameters reply="500 Unrecognized command"/>
  597. </event>
  598.  
  599. <event seq="88" time="2019-02-11 08:09:45.866087 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  600. <session id="1003" service="FTP" remoteAddress="8.8.8.8:51284" loc="CA/NA"/>
  601. <parameters reply="421 Internal server error; see server's logs for details"/>
  602. </event>
  603.  
  604. <event seq="89" time="2019-02-11 08:09:46.950324 -0700" app="BvSshServer 8.24" name="I_SESSION_DISCONNECTED_NORMALLY" desc="Session disconnected normally.">
  605. <session id="1003" service="FTP" remoteAddress="8.8.8.8:51284" loc="CA/NA"/>
  606. <parameters disconnectReason="Socket" socketBytesReceived="369" socketBytesSent="165" payloadBytesReceived="0" payloadBytesSent="0"/>
  607. <error type="Flow" component="FtpManager/socketReader" class="WinApi" code="10054" message="An existing connection was forcibly closed by the remote host." description="FlowSocketReader: Error receiving bytes"/>
  608. </event>
  609.  
  610. <event seq="90" time="2019-02-11 08:09:54.664474 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  611. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  612. <channel type="session" id="1"/>
  613. <sfs moduleName="FlowSfsRoot" code="31904" desc="Paths processed.">
  614. <parameters pathRaw="/2032-mydomain Rentals LP-Rentals Support" path="/2032-mydomain Rentals LP-Rentals Support"/>
  615. <handler moduleName="FlowSfsWin" mountPath="/"/>
  616. </sfs>
  617. </event>
  618.  
  619. <event seq="91" time="2019-02-11 08:09:54.664530 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  620. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  621. <channel type="session" id="1"/>
  622. <sfs moduleName="FlowSfsWin" mountPath="/" code="31000" desc="Querying real path succeeded.">
  623. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support" controlByte="NoCheck"/>
  624. </sfs>
  625. </event>
  626.  
  627. <event seq="92" time="2019-02-11 08:09:54.680385 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  628. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  629. <channel type="session" id="1"/>
  630. <sfs moduleName="FlowSfsRoot" code="26904" desc="Paths processed.">
  631. <parameters pathRaw="/2032-mydomain Rentals LP-Rentals Support" path="/2032-mydomain Rentals LP-Rentals Support"/>
  632. <handler moduleName="FlowSfsWin" mountPath="/"/>
  633. </sfs>
  634. </event>
  635.  
  636. <event seq="93" time="2019-02-11 08:09:54.680425 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  637. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  638. <channel type="session" id="1"/>
  639. <sfs moduleName="FlowSfsWin" mountPath="/" code="26000" desc="Opening directory succeeded.">
  640. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support"/>
  641. </sfs>
  642. </event>
  643.  
  644. <event seq="94" time="2019-02-11 08:09:54.695391 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  645. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  646. <channel type="session" id="1"/>
  647. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  648. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support" type="Directory"/>
  649. </sfs>
  650. </event>
  651.  
  652. <event seq="95" time="2019-02-11 08:09:54.710767 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  653. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  654. <channel type="session" id="1"/>
  655. <sfs moduleName="FlowSfsRoot" code="31904" desc="Paths processed.">
  656. <parameters pathRaw="/2032-mydomain Rentals LP-Rentals Support/." path="/2032-mydomain Rentals LP-Rentals Support"/>
  657. <handler moduleName="FlowSfsWin" mountPath="/"/>
  658. </sfs>
  659. </event>
  660.  
  661. <event seq="96" time="2019-02-11 08:09:54.710806 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  662. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  663. <channel type="session" id="1"/>
  664. <sfs moduleName="FlowSfsWin" mountPath="/" code="31000" desc="Querying real path succeeded.">
  665. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support" controlByte="NoCheck"/>
  666. </sfs>
  667. </event>
  668.  
  669. <event seq="97" time="2019-02-11 08:09:54.725542 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  670. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  671. <channel type="session" id="1"/>
  672. <sfs moduleName="FlowSfsRoot" code="26904" desc="Paths processed.">
  673. <parameters pathRaw="/2032-mydomain Rentals LP-Rentals Support" path="/2032-mydomain Rentals LP-Rentals Support"/>
  674. <handler moduleName="FlowSfsWin" mountPath="/"/>
  675. </sfs>
  676. </event>
  677.  
  678. <event seq="98" time="2019-02-11 08:09:54.725580 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  679. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  680. <channel type="session" id="1"/>
  681. <sfs moduleName="FlowSfsWin" mountPath="/" code="26000" desc="Opening directory succeeded.">
  682. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support"/>
  683. </sfs>
  684. </event>
  685.  
  686. <event seq="99" time="2019-02-11 08:09:54.741480 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  687. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  688. <channel type="session" id="1"/>
  689. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  690. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support" entriesCount="8" reachedEof="true"/>
  691. </sfs>
  692. </event>
  693.  
  694. <event seq="100" time="2019-02-11 08:09:54.741766 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  695. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  696. <channel type="session" id="1"/>
  697. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  698. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  699. </sfs>
  700. </event>
  701.  
  702. <event seq="101" time="2019-02-11 08:09:54.741798 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  703. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  704. <channel type="session" id="1"/>
  705. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  706. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  707. </sfs>
  708. </event>
  709.  
  710. <event seq="102" time="2019-02-11 08:09:54.741821 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  711. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  712. <channel type="session" id="1"/>
  713. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  714. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  715. </sfs>
  716. </event>
  717.  
  718. <event seq="103" time="2019-02-11 08:09:54.756494 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  719. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  720. <channel type="session" id="1"/>
  721. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  722. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  723. </sfs>
  724. </event>
  725.  
  726. <event seq="104" time="2019-02-11 08:09:54.771328 -0700" app="BvSshServer 8.24" name="I_SFS_LIST_DIRECTORY" desc="Virtual filesystem: list directory.">
  727. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  728. <channel type="session" id="1"/>
  729. <sfs moduleName="FlowSfsWin" mountPath="/" code="91000" desc="Listing directory ended.">
  730. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support" timeMs="45" entriesCount="8"/>
  731. </sfs>
  732. </event>
  733.  
  734. <event seq="105" time="2019-02-11 08:09:54.771365 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  735. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  736. <channel type="session" id="1"/>
  737. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  738. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support" type="Directory"/>
  739. </sfs>
  740. </event>
  741.  
  742. <event seq="106" time="2019-02-11 08:09:55.627405 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  743. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  744. <channel type="session" id="1"/>
  745. <sfs moduleName="FlowSfsRoot" code="31904" desc="Paths processed.">
  746. <parameters pathRaw="/2032-mydomain Rentals LP-Rentals Support/Env" path="/2032-mydomain Rentals LP-Rentals Support/Env"/>
  747. <handler moduleName="FlowSfsWin" mountPath="/"/>
  748. </sfs>
  749. </event>
  750.  
  751. <event seq="107" time="2019-02-11 08:09:55.627456 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  752. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  753. <channel type="session" id="1"/>
  754. <sfs moduleName="FlowSfsWin" mountPath="/" code="31000" desc="Querying real path succeeded.">
  755. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support\Env" controlByte="NoCheck"/>
  756. </sfs>
  757. </event>
  758.  
  759. <event seq="108" time="2019-02-11 08:09:55.642853 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  760. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  761. <channel type="session" id="1"/>
  762. <sfs moduleName="FlowSfsRoot" code="26904" desc="Paths processed.">
  763. <parameters pathRaw="/2032-mydomain Rentals LP-Rentals Support/Env" path="/2032-mydomain Rentals LP-Rentals Support/Env"/>
  764. <handler moduleName="FlowSfsWin" mountPath="/"/>
  765. </sfs>
  766. </event>
  767.  
  768. <event seq="109" time="2019-02-11 08:09:55.642890 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  769. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  770. <channel type="session" id="1"/>
  771. <sfs moduleName="FlowSfsWin" mountPath="/" code="26000" desc="Opening directory succeeded.">
  772. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support\Env"/>
  773. </sfs>
  774. </event>
  775.  
  776. <event seq="110" time="2019-02-11 08:09:55.657286 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  777. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  778. <channel type="session" id="1"/>
  779. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  780. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support\Env" type="Directory"/>
  781. </sfs>
  782. </event>
  783.  
  784. <event seq="111" time="2019-02-11 08:09:55.672256 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  785. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  786. <channel type="session" id="1"/>
  787. <sfs moduleName="FlowSfsRoot" code="31904" desc="Paths processed.">
  788. <parameters pathRaw="/2032-mydomain Rentals LP-Rentals Support/Env/." path="/2032-mydomain Rentals LP-Rentals Support/Env"/>
  789. <handler moduleName="FlowSfsWin" mountPath="/"/>
  790. </sfs>
  791. </event>
  792.  
  793. <event seq="112" time="2019-02-11 08:09:55.672293 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  794. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  795. <channel type="session" id="1"/>
  796. <sfs moduleName="FlowSfsWin" mountPath="/" code="31000" desc="Querying real path succeeded.">
  797. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support\Env" controlByte="NoCheck"/>
  798. </sfs>
  799. </event>
  800.  
  801. <event seq="113" time="2019-02-11 08:09:55.687333 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  802. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  803. <channel type="session" id="1"/>
  804. <sfs moduleName="FlowSfsRoot" code="26904" desc="Paths processed.">
  805. <parameters pathRaw="/2032-mydomain Rentals LP-Rentals Support/Env" path="/2032-mydomain Rentals LP-Rentals Support/Env"/>
  806. <handler moduleName="FlowSfsWin" mountPath="/"/>
  807. </sfs>
  808. </event>
  809.  
  810. <event seq="114" time="2019-02-11 08:09:55.687369 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  811. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  812. <channel type="session" id="1"/>
  813. <sfs moduleName="FlowSfsWin" mountPath="/" code="26000" desc="Opening directory succeeded.">
  814. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support\Env"/>
  815. </sfs>
  816. </event>
  817.  
  818. <event seq="115" time="2019-02-11 08:09:55.702524 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  819. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  820. <channel type="session" id="1"/>
  821. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  822. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support\Env" entriesCount="4" reachedEof="true"/>
  823. </sfs>
  824. </event>
  825.  
  826. <event seq="116" time="2019-02-11 08:09:55.702798 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  827. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  828. <channel type="session" id="1"/>
  829. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  830. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support\Env" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  831. </sfs>
  832. </event>
  833.  
  834. <event seq="117" time="2019-02-11 08:09:55.702828 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  835. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  836. <channel type="session" id="1"/>
  837. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  838. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support\Env" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  839. </sfs>
  840. </event>
  841.  
  842. <event seq="118" time="2019-02-11 08:09:55.702851 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  843. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  844. <channel type="session" id="1"/>
  845. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  846. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support\Env" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  847. </sfs>
  848. </event>
  849.  
  850. <event seq="119" time="2019-02-11 08:09:55.717247 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  851. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  852. <channel type="session" id="1"/>
  853. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  854. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support\Env" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  855. </sfs>
  856. </event>
  857.  
  858. <event seq="120" time="2019-02-11 08:09:55.731460 -0700" app="BvSshServer 8.24" name="I_SFS_LIST_DIRECTORY" desc="Virtual filesystem: list directory.">
  859. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  860. <channel type="session" id="1"/>
  861. <sfs moduleName="FlowSfsWin" mountPath="/" code="91000" desc="Listing directory ended.">
  862. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support\Env" timeMs="43" entriesCount="4"/>
  863. </sfs>
  864. </event>
  865.  
  866. <event seq="121" time="2019-02-11 08:09:55.731497 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  867. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  868. <channel type="session" id="1"/>
  869. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  870. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support\Env" type="Directory"/>
  871. </sfs>
  872. </event>
  873.  
  874. <event seq="122" time="2019-02-11 08:09:56.921379 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  875. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  876. <channel type="session" id="1"/>
  877. <sfs moduleName="FlowSfsRoot" code="31904" desc="Paths processed.">
  878. <parameters pathRaw="/2032-mydomain Rentals LP-Rentals Support/Env/HDD Branch" path="/2032-mydomain Rentals LP-Rentals Support/Env/HDD Branch"/>
  879. <handler moduleName="FlowSfsWin" mountPath="/"/>
  880. </sfs>
  881. </event>
  882.  
  883. <event seq="123" time="2019-02-11 08:09:56.921430 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  884. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  885. <channel type="session" id="1"/>
  886. <sfs moduleName="FlowSfsWin" mountPath="/" code="31000" desc="Querying real path succeeded.">
  887. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support\Env\HDD Branch" controlByte="NoCheck"/>
  888. </sfs>
  889. </event>
  890.  
  891. <event seq="124" time="2019-02-11 08:09:56.936482 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  892. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  893. <channel type="session" id="1"/>
  894. <sfs moduleName="FlowSfsRoot" code="26904" desc="Paths processed.">
  895. <parameters pathRaw="/2032-mydomain Rentals LP-Rentals Support/Env/HDD Branch" path="/2032-mydomain Rentals LP-Rentals Support/Env/HDD Branch"/>
  896. <handler moduleName="FlowSfsWin" mountPath="/"/>
  897. </sfs>
  898. </event>
  899.  
  900. <event seq="125" time="2019-02-11 08:09:56.936519 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  901. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  902. <channel type="session" id="1"/>
  903. <sfs moduleName="FlowSfsWin" mountPath="/" code="26000" desc="Opening directory succeeded.">
  904. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support\Env\HDD Branch"/>
  905. </sfs>
  906. </event>
  907.  
  908. <event seq="126" time="2019-02-11 08:09:56.951262 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  909. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  910. <channel type="session" id="1"/>
  911. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  912. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support\Env\HDD Branch" type="Directory"/>
  913. </sfs>
  914. </event>
  915.  
  916. <event seq="127" time="2019-02-11 08:09:56.966255 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  917. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  918. <channel type="session" id="1"/>
  919. <sfs moduleName="FlowSfsRoot" code="31904" desc="Paths processed.">
  920. <parameters pathRaw="/2032-mydomain Rentals LP-Rentals Support/Env/HDD Branch/." path="/2032-mydomain Rentals LP-Rentals Support/Env/HDD Branch"/>
  921. <handler moduleName="FlowSfsWin" mountPath="/"/>
  922. </sfs>
  923. </event>
  924.  
  925. <event seq="128" time="2019-02-11 08:09:56.966292 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  926. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  927. <channel type="session" id="1"/>
  928. <sfs moduleName="FlowSfsWin" mountPath="/" code="31000" desc="Querying real path succeeded.">
  929. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support\Env\HDD Branch" controlByte="NoCheck"/>
  930. </sfs>
  931. </event>
  932.  
  933. <event seq="129" time="2019-02-11 08:09:56.981346 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  934. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  935. <channel type="session" id="1"/>
  936. <sfs moduleName="FlowSfsRoot" code="26904" desc="Paths processed.">
  937. <parameters pathRaw="/2032-mydomain Rentals LP-Rentals Support/Env/HDD Branch" path="/2032-mydomain Rentals LP-Rentals Support/Env/HDD Branch"/>
  938. <handler moduleName="FlowSfsWin" mountPath="/"/>
  939. </sfs>
  940. </event>
  941.  
  942. <event seq="130" time="2019-02-11 08:09:56.981382 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  943. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  944. <channel type="session" id="1"/>
  945. <sfs moduleName="FlowSfsWin" mountPath="/" code="26000" desc="Opening directory succeeded.">
  946. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support\Env\HDD Branch"/>
  947. </sfs>
  948. </event>
  949.  
  950. <event seq="131" time="2019-02-11 08:09:56.997749 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  951. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  952. <channel type="session" id="1"/>
  953. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  954. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support\Env\HDD Branch" entriesCount="12" reachedEof="true"/>
  955. </sfs>
  956. </event>
  957.  
  958. <event seq="132" time="2019-02-11 08:09:56.998014 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  959. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  960. <channel type="session" id="1"/>
  961. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  962. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support\Env\HDD Branch" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  963. </sfs>
  964. </event>
  965.  
  966. <event seq="133" time="2019-02-11 08:09:56.998044 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  967. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  968. <channel type="session" id="1"/>
  969. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  970. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support\Env\HDD Branch" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  971. </sfs>
  972. </event>
  973.  
  974. <event seq="134" time="2019-02-11 08:09:56.998067 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  975. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  976. <channel type="session" id="1"/>
  977. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  978. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support\Env\HDD Branch" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  979. </sfs>
  980. </event>
  981.  
  982. <event seq="135" time="2019-02-11 08:09:57.013240 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  983. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  984. <channel type="session" id="1"/>
  985. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  986. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support\Env\HDD Branch" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  987. </sfs>
  988. </event>
  989.  
  990. <event seq="136" time="2019-02-11 08:09:57.027318 -0700" app="BvSshServer 8.24" name="I_SFS_LIST_DIRECTORY" desc="Virtual filesystem: list directory.">
  991. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  992. <channel type="session" id="1"/>
  993. <sfs moduleName="FlowSfsWin" mountPath="/" code="91000" desc="Listing directory ended.">
  994. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support\Env\HDD Branch" timeMs="45" entriesCount="12"/>
  995. </sfs>
  996. </event>
  997.  
  998. <event seq="137" time="2019-02-11 08:09:57.027355 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  999. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1000. <channel type="session" id="1"/>
  1001. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  1002. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support\Env\HDD Branch" type="Directory"/>
  1003. </sfs>
  1004. </event>
  1005.  
  1006. <event seq="138" time="2019-02-11 08:09:57.658404 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  1007. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1008. <channel type="session" id="1"/>
  1009. <sfs moduleName="FlowSfsRoot" code="31904" desc="Paths processed.">
  1010. <parameters pathRaw="/2032-mydomain Rentals LP-Rentals Support/Env/HDD Branch/.." path="/2032-mydomain Rentals LP-Rentals Support/Env"/>
  1011. <handler moduleName="FlowSfsWin" mountPath="/"/>
  1012. </sfs>
  1013. </event>
  1014.  
  1015. <event seq="139" time="2019-02-11 08:09:57.658455 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  1016. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1017. <channel type="session" id="1"/>
  1018. <sfs moduleName="FlowSfsWin" mountPath="/" code="31000" desc="Querying real path succeeded.">
  1019. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support\Env" controlByte="NoCheck"/>
  1020. </sfs>
  1021. </event>
  1022.  
  1023. <event seq="140" time="2019-02-11 08:09:57.673358 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  1024. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1025. <channel type="session" id="1"/>
  1026. <sfs moduleName="FlowSfsRoot" code="26904" desc="Paths processed.">
  1027. <parameters pathRaw="/2032-mydomain Rentals LP-Rentals Support/Env" path="/2032-mydomain Rentals LP-Rentals Support/Env"/>
  1028. <handler moduleName="FlowSfsWin" mountPath="/"/>
  1029. </sfs>
  1030. </event>
  1031.  
  1032. <event seq="141" time="2019-02-11 08:09:57.673404 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  1033. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1034. <channel type="session" id="1"/>
  1035. <sfs moduleName="FlowSfsWin" mountPath="/" code="26000" desc="Opening directory succeeded.">
  1036. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support\Env"/>
  1037. </sfs>
  1038. </event>
  1039.  
  1040. <event seq="142" time="2019-02-11 08:09:57.688256 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  1041. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1042. <channel type="session" id="1"/>
  1043. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  1044. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support\Env" type="Directory"/>
  1045. </sfs>
  1046. </event>
  1047.  
  1048. <event seq="143" time="2019-02-11 08:09:58.235414 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  1049. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1050. <channel type="session" id="1"/>
  1051. <sfs moduleName="FlowSfsRoot" code="31904" desc="Paths processed.">
  1052. <parameters pathRaw="/2032-mydomain Rentals LP-Rentals Support/Env/.." path="/2032-mydomain Rentals LP-Rentals Support"/>
  1053. <handler moduleName="FlowSfsWin" mountPath="/"/>
  1054. </sfs>
  1055. </event>
  1056.  
  1057. <event seq="144" time="2019-02-11 08:09:58.235465 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  1058. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1059. <channel type="session" id="1"/>
  1060. <sfs moduleName="FlowSfsWin" mountPath="/" code="31000" desc="Querying real path succeeded.">
  1061. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support" controlByte="NoCheck"/>
  1062. </sfs>
  1063. </event>
  1064.  
  1065. <event seq="145" time="2019-02-11 08:09:58.250332 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  1066. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1067. <channel type="session" id="1"/>
  1068. <sfs moduleName="FlowSfsRoot" code="26904" desc="Paths processed.">
  1069. <parameters pathRaw="/2032-mydomain Rentals LP-Rentals Support" path="/2032-mydomain Rentals LP-Rentals Support"/>
  1070. <handler moduleName="FlowSfsWin" mountPath="/"/>
  1071. </sfs>
  1072. </event>
  1073.  
  1074. <event seq="146" time="2019-02-11 08:09:58.250369 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  1075. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1076. <channel type="session" id="1"/>
  1077. <sfs moduleName="FlowSfsWin" mountPath="/" code="26000" desc="Opening directory succeeded.">
  1078. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support"/>
  1079. </sfs>
  1080. </event>
  1081.  
  1082. <event seq="147" time="2019-02-11 08:09:58.265244 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  1083. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1084. <channel type="session" id="1"/>
  1085. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  1086. <parameters path="C:\Share\2032-mydomain Rentals LP-Rentals Support" type="Directory"/>
  1087. </sfs>
  1088. </event>
  1089.  
  1090. <event seq="148" time="2019-02-11 08:09:58.931348 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  1091. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1092. <channel type="session" id="1"/>
  1093. <sfs moduleName="FlowSfsRoot" code="31904" desc="Paths processed.">
  1094. <parameters pathRaw="/2032-mydomain Rentals LP-Rentals Support/.." path="/"/>
  1095. <handler moduleName="FlowSfsWin" mountPath="/"/>
  1096. </sfs>
  1097. </event>
  1098.  
  1099. <event seq="149" time="2019-02-11 08:09:58.931392 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  1100. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1101. <channel type="session" id="1"/>
  1102. <sfs moduleName="FlowSfsWin" mountPath="/" code="31000" desc="Querying real path succeeded.">
  1103. <parameters path="C:\Share" controlByte="NoCheck"/>
  1104. </sfs>
  1105. </event>
  1106.  
  1107. <event seq="150" time="2019-02-11 08:09:58.946344 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  1108. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1109. <channel type="session" id="1"/>
  1110. <sfs moduleName="FlowSfsRoot" code="26904" desc="Paths processed.">
  1111. <parameters pathRaw="/" path="/"/>
  1112. <handler moduleName="FlowSfsWin" mountPath="/"/>
  1113. </sfs>
  1114. </event>
  1115.  
  1116. <event seq="151" time="2019-02-11 08:09:58.946380 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  1117. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1118. <channel type="session" id="1"/>
  1119. <sfs moduleName="FlowSfsWin" mountPath="/" code="26000" desc="Opening directory succeeded.">
  1120. <parameters path="C:\Share"/>
  1121. </sfs>
  1122. </event>
  1123.  
  1124. <event seq="152" time="2019-02-11 08:09:58.960391 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  1125. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1126. <channel type="session" id="1"/>
  1127. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  1128. <parameters path="C:\Share" type="Directory"/>
  1129. </sfs>
  1130. </event>
  1131.  
  1132. <event seq="153" time="2019-02-11 08:10:10.848275 -0700" app="BvSshServer 8.24" name="I_CONNECT_ACCEPTED" desc="Connection accepted.">
  1133. <session id="1004" service="FTP" remoteAddress="8.8.8.8:51285" loc="CA/NA"/>
  1134. <location continent="North America" country="Canada"/>
  1135. <parameters addressRule="AnyIP" listenAddress="192.168.0.2:21"/>
  1136. <sessions ssh="1" sshAuth="1" ftp="1" ftpAuth="0"/>
  1137. </event>
  1138.  
  1139. <event seq="154" time="2019-02-11 08:10:10.848670 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1140. <session id="1004" service="FTP" remoteAddress="8.8.8.8:51285" loc="CA/NA"/>
  1141. <parameters reply="220 Bitvise SSH Server 8.24"/>
  1142. </event>
  1143.  
  1144. <event seq="155" time="2019-02-11 08:10:10.848748 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1145. <session id="1004" service="FTP" remoteAddress="8.8.8.8:51285" loc="CA/NA"/>
  1146. <parameters command="????l???h??皦}=ER�?&amp;n?�?�/[f2i4�?z�bB?g?��??:????????�,̩�"/>
  1147. </event>
  1148.  
  1149. <event seq="156" time="2019-02-11 08:10:10.848776 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1150. <session id="1004" service="FTP" remoteAddress="8.8.8.8:51285" loc="CA/NA"/>
  1151. <parameters reply="500 Unrecognized command"/>
  1152. </event>
  1153.  
  1154. <event seq="157" time="2019-02-11 08:10:10.848791 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1155. <session id="1004" service="FTP" remoteAddress="8.8.8.8:51285" loc="CA/NA"/>
  1156. <parameters command="���+� ���0̨�?�/�??�?5��?�?/��?�̪?9��?�?3��??????????????"/>
  1157. </event>
  1158.  
  1159. <event seq="158" time="2019-02-11 08:10:10.848809 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1160. <session id="1004" service="FTP" remoteAddress="8.8.8.8:51285" loc="CA/NA"/>
  1161. <parameters reply="500 Unrecognized command"/>
  1162. </event>
  1163.  
  1164. <event seq="159" time="2019-02-11 08:10:10.848821 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1165. <session id="1004" service="FTP" remoteAddress="8.8.8.8:51285" loc="CA/NA"/>
  1166. <parameters command="??????????????????????????????? ?????"/>
  1167. </event>
  1168.  
  1169. <event seq="160" time="2019-02-11 08:10:10.848838 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1170. <session id="1004" service="FTP" remoteAddress="8.8.8.8:51285" loc="CA/NA"/>
  1171. <parameters reply="500 Unrecognized command"/>
  1172. </event>
  1173.  
  1174. <event seq="161" time="2019-02-11 08:10:10.848857 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1175. <session id="1004" service="FTP" remoteAddress="8.8.8.8:51285" loc="CA/NA"/>
  1176. <parameters command="??????????????? ???????????????????#???3?�?�???a?K9���#AzB��i���}���?�?Q�']�?7��?��/�|�������?ZH��O��MN�&gt;�?�f�?)�x�f?Z?:��"/>
  1177. </event>
  1178.  
  1179. <event seq="162" time="2019-02-11 08:10:10.848923 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1180. <session id="1004" service="FTP" remoteAddress="8.8.8.8:51285" loc="CA/NA"/>
  1181. <parameters reply="500 Unrecognized command"/>
  1182. </event>
  1183.  
  1184. <event seq="163" time="2019-02-11 08:10:10.864496 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1185. <session id="1004" service="FTP" remoteAddress="8.8.8.8:51285" loc="CA/NA"/>
  1186. <parameters reply="421 Internal server error; see server's logs for details"/>
  1187. </event>
  1188.  
  1189. <event seq="164" time="2019-02-11 08:10:11.748402 -0700" app="BvSshServer 8.24" name="I_SESSION_DISCONNECTED_NORMALLY" desc="Session disconnected normally.">
  1190. <session id="1004" service="FTP" remoteAddress="8.8.8.8:51285" loc="CA/NA"/>
  1191. <parameters disconnectReason="Socket" socketBytesReceived="369" socketBytesSent="191" payloadBytesReceived="0" payloadBytesSent="0"/>
  1192. <error type="Flow" component="FtpManager/socketReader" class="WinApi" code="10054" message="An existing connection was forcibly closed by the remote host." description="FlowSocketReader: Error receiving bytes"/>
  1193. </event>
  1194.  
  1195. <event seq="165" time="2019-02-11 08:10:15.784519 -0700" app="BvSshServer 8.24" name="I_CONNECT_ACCEPTED" desc="Connection accepted.">
  1196. <session id="1005" service="FTP" remoteAddress="8.8.8.8:51286" loc="CA/NA"/>
  1197. <location continent="North America" country="Canada"/>
  1198. <parameters addressRule="AnyIP" listenAddress="192.168.0.2:21"/>
  1199. <sessions ssh="1" sshAuth="1" ftp="1" ftpAuth="0"/>
  1200. </event>
  1201.  
  1202. <event seq="166" time="2019-02-11 08:10:15.784968 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1203. <session id="1005" service="FTP" remoteAddress="8.8.8.8:51286" loc="CA/NA"/>
  1204. <parameters reply="220 Bitvise SSH Server 8.24"/>
  1205. </event>
  1206.  
  1207. <event seq="167" time="2019-02-11 08:10:15.785050 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1208. <session id="1005" service="FTP" remoteAddress="8.8.8.8:51286" loc="CA/NA"/>
  1209. <parameters command="????l???h??��f9�qK�7?�ѳN�?��&amp;@?h-�o�����??:????????�,̩�"/>
  1210. </event>
  1211.  
  1212. <event seq="168" time="2019-02-11 08:10:15.785089 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1213. <session id="1005" service="FTP" remoteAddress="8.8.8.8:51286" loc="CA/NA"/>
  1214. <parameters reply="500 Unrecognized command"/>
  1215. </event>
  1216.  
  1217. <event seq="169" time="2019-02-11 08:10:15.785106 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1218. <session id="1005" service="FTP" remoteAddress="8.8.8.8:51286" loc="CA/NA"/>
  1219. <parameters command="���+� ���0̨�?�/�??�?5��?�?/��?�̪?9��?�?3��??????????????"/>
  1220. </event>
  1221.  
  1222. <event seq="170" time="2019-02-11 08:10:15.785125 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1223. <session id="1005" service="FTP" remoteAddress="8.8.8.8:51286" loc="CA/NA"/>
  1224. <parameters reply="500 Unrecognized command"/>
  1225. </event>
  1226.  
  1227. <event seq="171" time="2019-02-11 08:10:15.785138 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1228. <session id="1005" service="FTP" remoteAddress="8.8.8.8:51286" loc="CA/NA"/>
  1229. <parameters command="??????????????????????????????? ?????"/>
  1230. </event>
  1231.  
  1232. <event seq="172" time="2019-02-11 08:10:15.785159 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1233. <session id="1005" service="FTP" remoteAddress="8.8.8.8:51286" loc="CA/NA"/>
  1234. <parameters reply="500 Unrecognized command"/>
  1235. </event>
  1236.  
  1237. <event seq="173" time="2019-02-11 08:10:15.800646 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1238. <session id="1005" service="FTP" remoteAddress="8.8.8.8:51286" loc="CA/NA"/>
  1239. <parameters reply="421 Internal server error; see server's logs for details"/>
  1240. </event>
  1241.  
  1242. <event seq="174" time="2019-02-11 08:10:16.785586 -0700" app="BvSshServer 8.24" name="I_SESSION_DISCONNECTED_NORMALLY" desc="Session disconnected normally.">
  1243. <session id="1005" service="FTP" remoteAddress="8.8.8.8:51286" loc="CA/NA"/>
  1244. <parameters disconnectReason="Socket" socketBytesReceived="369" socketBytesSent="165" payloadBytesReceived="0" payloadBytesSent="0"/>
  1245. <error type="Flow" component="FtpManager/socketReader" class="WinApi" code="10054" message="An existing connection was forcibly closed by the remote host." description="FlowSocketReader: Error receiving bytes"/>
  1246. </event>
  1247.  
  1248. <event seq="175" time="2019-02-11 08:11:27.064139 -0700" app="BvSshServer 8.24" name="I_CONNECT_ACCEPTED" desc="Connection accepted.">
  1249. <session id="1006" service="FTP" remoteAddress="8.8.8.8:51290" loc="CA/NA"/>
  1250. <location continent="North America" country="Canada"/>
  1251. <parameters addressRule="AnyIP" listenAddress="192.168.0.2:21"/>
  1252. <sessions ssh="1" sshAuth="1" ftp="1" ftpAuth="0"/>
  1253. </event>
  1254.  
  1255. <event seq="176" time="2019-02-11 08:11:27.064558 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1256. <session id="1006" service="FTP" remoteAddress="8.8.8.8:51290" loc="CA/NA"/>
  1257. <parameters reply="220 Bitvise SSH Server 8.24"/>
  1258. </event>
  1259.  
  1260. <event seq="177" time="2019-02-11 08:11:27.064642 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1261. <session id="1006" service="FTP" remoteAddress="8.8.8.8:51290" loc="CA/NA"/>
  1262. <parameters command="????l???h???�y�����O�w?��3��q�n!�R?�T? �A�???:????????�,̩�"/>
  1263. </event>
  1264.  
  1265. <event seq="178" time="2019-02-11 08:11:27.064673 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1266. <session id="1006" service="FTP" remoteAddress="8.8.8.8:51290" loc="CA/NA"/>
  1267. <parameters reply="500 Unrecognized command"/>
  1268. </event>
  1269.  
  1270. <event seq="179" time="2019-02-11 08:11:27.064689 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1271. <session id="1006" service="FTP" remoteAddress="8.8.8.8:51290" loc="CA/NA"/>
  1272. <parameters command="���+� ���0̨�?�/�??�?5��?�?/��?�̪?9��?�?3��??????????????"/>
  1273. </event>
  1274.  
  1275. <event seq="180" time="2019-02-11 08:11:27.064708 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1276. <session id="1006" service="FTP" remoteAddress="8.8.8.8:51290" loc="CA/NA"/>
  1277. <parameters reply="500 Unrecognized command"/>
  1278. </event>
  1279.  
  1280. <event seq="181" time="2019-02-11 08:11:27.064721 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1281. <session id="1006" service="FTP" remoteAddress="8.8.8.8:51290" loc="CA/NA"/>
  1282. <parameters command="??????????????????????????????? ?????"/>
  1283. </event>
  1284.  
  1285. <event seq="182" time="2019-02-11 08:11:27.064752 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1286. <session id="1006" service="FTP" remoteAddress="8.8.8.8:51290" loc="CA/NA"/>
  1287. <parameters reply="500 Unrecognized command"/>
  1288. </event>
  1289.  
  1290. <event seq="183" time="2019-02-11 08:11:27.095837 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1291. <session id="1006" service="FTP" remoteAddress="8.8.8.8:51290" loc="CA/NA"/>
  1292. <parameters reply="421 Internal server error; see server's logs for details"/>
  1293. </event>
  1294.  
  1295. <event seq="184" time="2019-02-11 08:11:28.064775 -0700" app="BvSshServer 8.24" name="I_SESSION_DISCONNECTED_NORMALLY" desc="Session disconnected normally.">
  1296. <session id="1006" service="FTP" remoteAddress="8.8.8.8:51290" loc="CA/NA"/>
  1297. <parameters disconnectReason="Socket" socketBytesReceived="369" socketBytesSent="165" payloadBytesReceived="0" payloadBytesSent="0"/>
  1298. <error type="Flow" component="FtpManager/socketReader" class="WinApi" code="10054" message="An existing connection was forcibly closed by the remote host." description="FlowSocketReader: Error receiving bytes"/>
  1299. </event>
  1300.  
  1301. <event seq="185" time="2019-02-11 08:11:32.103232 -0700" app="BvSshServer 8.24" name="I_CONNECT_ACCEPTED" desc="Connection accepted.">
  1302. <session id="1007" service="FTP" remoteAddress="8.8.8.8:51291" loc="CA/NA"/>
  1303. <location continent="North America" country="Canada"/>
  1304. <parameters addressRule="AnyIP" listenAddress="192.168.0.2:21"/>
  1305. <sessions ssh="1" sshAuth="1" ftp="1" ftpAuth="0"/>
  1306. </event>
  1307.  
  1308. <event seq="186" time="2019-02-11 08:11:32.103645 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1309. <session id="1007" service="FTP" remoteAddress="8.8.8.8:51291" loc="CA/NA"/>
  1310. <parameters reply="220 Bitvise SSH Server 8.24"/>
  1311. </event>
  1312.  
  1313. <event seq="187" time="2019-02-11 08:11:32.103873 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1314. <session id="1007" service="FTP" remoteAddress="8.8.8.8:51291" loc="CA/NA"/>
  1315. <parameters command="????l???h???��V�P��Ä8&quot;�?��O�?JhCrd2}��,�3&gt;??:????????�,̩�"/>
  1316. </event>
  1317.  
  1318. <event seq="188" time="2019-02-11 08:11:32.103927 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1319. <session id="1007" service="FTP" remoteAddress="8.8.8.8:51291" loc="CA/NA"/>
  1320. <parameters reply="500 Unrecognized command"/>
  1321. </event>
  1322.  
  1323. <event seq="189" time="2019-02-11 08:11:32.103946 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1324. <session id="1007" service="FTP" remoteAddress="8.8.8.8:51291" loc="CA/NA"/>
  1325. <parameters command="���+� ���0̨�?�/�??�?5��?�?/��?�̪?9��?�?3��??????????????"/>
  1326. </event>
  1327.  
  1328. <event seq="190" time="2019-02-11 08:11:32.103967 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1329. <session id="1007" service="FTP" remoteAddress="8.8.8.8:51291" loc="CA/NA"/>
  1330. <parameters reply="500 Unrecognized command"/>
  1331. </event>
  1332.  
  1333. <event seq="191" time="2019-02-11 08:11:32.103980 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1334. <session id="1007" service="FTP" remoteAddress="8.8.8.8:51291" loc="CA/NA"/>
  1335. <parameters command="??????????????????????????????? ?????"/>
  1336. </event>
  1337.  
  1338. <event seq="192" time="2019-02-11 08:11:32.103997 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1339. <session id="1007" service="FTP" remoteAddress="8.8.8.8:51291" loc="CA/NA"/>
  1340. <parameters reply="500 Unrecognized command"/>
  1341. </event>
  1342.  
  1343. <event seq="193" time="2019-02-11 08:11:32.104016 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1344. <session id="1007" service="FTP" remoteAddress="8.8.8.8:51291" loc="CA/NA"/>
  1345. <parameters command="??????????????? ???????????????????#???3?�?�???a?�����dA��P2J���l??W��BF�}�wOF�G%��2�ٹ��&lt;�_�$Y�*��[�)4�?�?�??��hhDQJ?@?��=їk��q?�$?��6�U�?n!+??? W�[��?�]�n)"/>
  1346. </event>
  1347.  
  1348. <event seq="194" time="2019-02-11 08:11:32.104080 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1349. <session id="1007" service="FTP" remoteAddress="8.8.8.8:51291" loc="CA/NA"/>
  1350. <parameters reply="500 Unrecognized command"/>
  1351. </event>
  1352.  
  1353. <event seq="195" time="2019-02-11 08:11:32.122809 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1354. <session id="1007" service="FTP" remoteAddress="8.8.8.8:51291" loc="CA/NA"/>
  1355. <parameters reply="421 Internal server error; see server's logs for details"/>
  1356. </event>
  1357.  
  1358. <event seq="196" time="2019-02-11 08:11:33.107009 -0700" app="BvSshServer 8.24" name="I_SESSION_DISCONNECTED_NORMALLY" desc="Session disconnected normally.">
  1359. <session id="1007" service="FTP" remoteAddress="8.8.8.8:51291" loc="CA/NA"/>
  1360. <parameters disconnectReason="Socket" socketBytesReceived="369" socketBytesSent="191" payloadBytesReceived="0" payloadBytesSent="0"/>
  1361. <error type="Flow" component="FtpManager/socketReader" class="WinApi" code="10054" message="An existing connection was forcibly closed by the remote host." description="FlowSocketReader: Error receiving bytes"/>
  1362. </event>
  1363.  
  1364. <event seq="197" time="2019-02-11 08:11:52.450912 -0700" app="BvSshServer 8.24" name="I_CONNECT_ACCEPTED" desc="Connection accepted.">
  1365. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA"/>
  1366. <location continent="North America" country="Canada"/>
  1367. <parameters addressRule="AnyIP" listenAddress="192.168.0.2:21"/>
  1368. <sessions ssh="1" sshAuth="1" ftp="1" ftpAuth="0"/>
  1369. </event>
  1370.  
  1371. <event seq="198" time="2019-02-11 08:11:52.451351 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1372. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA"/>
  1373. <parameters reply="220 Bitvise SSH Server 8.24"/>
  1374. </event>
  1375.  
  1376. <event seq="199" time="2019-02-11 08:11:52.465308 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1377. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA"/>
  1378. <parameters command="AUTH TLS"/>
  1379. </event>
  1380.  
  1381. <event seq="200" time="2019-02-11 08:11:52.465347 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1382. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA"/>
  1383. <parameters reply="234 Security mechanism set to TLS"/>
  1384. </event>
  1385.  
  1386. <event seq="201" time="2019-02-11 08:11:52.660865 -0700" app="BvSshServer 8.24" name="I_FTP_CONTROL_TLS_NEGOTIATED" desc="TLS algorithms for FTP control connection negotiated.">
  1387. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA"/>
  1388. <parameters negNr="1" protocol="TLS 1.2" cipherSuite="TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256"/>
  1389. </event>
  1390.  
  1391. <event seq="202" time="2019-02-11 08:11:54.701502 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1392. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA"/>
  1393. <parameters command="USER testuser"/>
  1394. </event>
  1395.  
  1396. <event seq="203" time="2019-02-11 08:11:54.701574 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1397. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA"/>
  1398. <parameters reply="331 Need password"/>
  1399. </event>
  1400.  
  1401. <event seq="204" time="2019-02-11 08:11:54.720387 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1402. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA"/>
  1403. <parameters command="PASS ***"/>
  1404. </event>
  1405.  
  1406. <event seq="205" time="2019-02-11 08:11:54.720420 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_ATTEMPT_STARTED" desc="User authentication attempt started.">
  1407. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA"/>
  1408. <authentication attemptNr="1" userName="testuser" method="password"/>
  1409. </event>
  1410.  
  1411. <event seq="206" time="2019-02-11 08:11:54.748289 -0700" app="BvSshServer 8.24" name="T_LOGON_PROCEDURE_TIMING" desc="Logon procedure timing.">
  1412. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA"/>
  1413. <parameters procedure="LogonUser()" timerMs="2"/>
  1414. </event>
  1415.  
  1416. <event seq="207" time="2019-02-11 08:11:54.748322 -0700" app="BvSshServer 8.24" name="T_LOGON_TOKEN_ELEVATION_CHANGE_FAILED" desc="Could not change or obtain user token elevation state.">
  1417. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA"/>
  1418. <parameters desiredElevation="Yes" failureReason="LinkedTokenNotAvailable"/>
  1419. <help message="Elevation state cannot be changed for sessions with the 'network' logon type."/>
  1420. </event>
  1421.  
  1422. <event seq="208" time="2019-02-11 08:11:54.759270 -0700" app="BvSshServer 8.24" name="T_LOGON_PROCEDURE_TIMING" desc="Logon procedure timing.">
  1423. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA"/>
  1424. <parameters procedure="NetUserGetInfo()" timerMs="10"/>
  1425. </event>
  1426.  
  1427. <event seq="209" time="2019-02-11 08:11:54.759833 -0700" app="BvSshServer 8.24" name="I_LOGON_AUTH_SUCCEEDED" desc="User authentication succeeded.">
  1428. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1429. <authentication attemptNr="1" serialize="completion" userName="testuser" method="password"/>
  1430. <parameters accountSettings="testuser" groupSettings="Virtual Users" tokenType="LogonUser" tokenLogonType="Network" tokenElevation="Restricted"/>
  1431. </event>
  1432.  
  1433. <event seq="210" time="2019-02-11 08:11:54.759995 -0700" app="BvSshServer 8.24" name="T_LOGON_HOME_DIRECTORY_RETRIEVE_ERROR" desc="Error retrieving home directory.">
  1434. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1435. <error type="WinApi" operation="GetUserProfileDirectory()" code="2" message="The system cannot find the file specified."/>
  1436. </event>
  1437.  
  1438. <event seq="211" time="2019-02-11 08:11:54.760826 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_ATTEMPT_ENDED" desc="User authentication attempt ended.">
  1439. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1440. <authentication attemptNr="1" serialize="completion" userName="testuser" method="password"/>
  1441. </event>
  1442.  
  1443. <event seq="212" time="2019-02-11 08:11:54.760858 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1444. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1445. <parameters reply="230 User logged in"/>
  1446. </event>
  1447.  
  1448. <event seq="213" time="2019-02-11 08:11:54.762492 -0700" app="BvSshServer 8.24" name="T_SUBSYS_EXECUTED" desc="SSH server subsystem executed.">
  1449. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1450. <parameters exeFile="SfsServer.exe"/>
  1451. </event>
  1452.  
  1453. <event seq="214" time="2019-02-11 08:11:54.781599 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  1454. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1455. <sfs moduleName="FlowSfsRoot" code="11901" desc="Initializing module with the following settings.">
  1456. <parameters
  1457. settings="Root
  1458. HomePath=/
  1459. CreateHome=No
  1460. ShowRelative=Yes
  1461. DelayInit=Yes
  1462. Provider=FlowSfsWin
  1463. MountPath=/
  1464. MountMode=List,ReadExist,WriteExist,ReadWriteDeleteNew,CreateDir,CreateLink
  1465. RootPath=C:\Share
  1466. CreateRoot=No
  1467. MaxPathLength=3000
  1468. DelayInit=Yes
  1469. ShowEmptyDir=IfNoAccess
  1470. FileShareBeh=Default
  1471. FileShare=Read,Write
  1472. OwnerGroup=IfUnknown-Default
  1473. Acl=IfUnknownAce-DefaultAcl"/>
  1474. </sfs>
  1475. </event>
  1476.  
  1477. <event seq="215" time="2019-02-11 08:11:54.781648 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  1478. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1479. <sfs moduleName="FlowSfsRoot" code="11000" desc="Initializing module succeeded."/>
  1480. </event>
  1481.  
  1482. <event seq="216" time="2019-02-11 08:11:54.781664 -0700" app="BvSshServer 8.24" name="I_SFS_QUERY_HOME_DIRECTORY" desc="Virtual filesystem: query home directory.">
  1483. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1484. <sfs moduleName="FlowSfsRoot" code="40000" desc="Querying home directory succeeded.">
  1485. <parameters homePath="/"/>
  1486. </sfs>
  1487. </event>
  1488.  
  1489. <event seq="217" time="2019-02-11 08:11:54.783895 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1490. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1491. <parameters command="SYST"/>
  1492. </event>
  1493.  
  1494. <event seq="218" time="2019-02-11 08:11:54.783932 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1495. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1496. <parameters reply="215 UNIX"/>
  1497. </event>
  1498.  
  1499. <event seq="219" time="2019-02-11 08:11:54.798365 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1500. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1501. <parameters command="FEAT"/>
  1502. </event>
  1503.  
  1504. <event seq="220" time="2019-02-11 08:11:54.798396 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1505. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1506. <parameters
  1507. reply="211-Features:
  1508. LANG EN*
  1509. UTF8
  1510. MDTM
  1511. SIZE
  1512. REST STREAM
  1513. TVFS
  1514. AUTH TLS
  1515. AUTH SSL
  1516. PROT
  1517. PBSZ
  1518. EPSV
  1519. HASH SHA-512;SHA-256;SHA-1*;MD5;CRC32
  1520. XCRC &quot;filename&quot; SP EP
  1521. XMD5 &quot;filename&quot; SP EP
  1522. XSHA &quot;filename&quot; SP EP
  1523. XSHA1 &quot;filename&quot; SP EP
  1524. XSHA256 &quot;filename&quot; SP EP
  1525. XSHA512 &quot;filename&quot; SP EP
  1526. 211 End"/>
  1527. </event>
  1528.  
  1529. <event seq="221" time="2019-02-11 08:11:54.812353 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1530. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1531. <parameters command="OPTS UTF8 ON"/>
  1532. </event>
  1533.  
  1534. <event seq="222" time="2019-02-11 08:11:54.812392 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1535. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1536. <parameters reply="202 The UTF8 option is already enabled"/>
  1537. </event>
  1538.  
  1539. <event seq="223" time="2019-02-11 08:11:54.826353 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1540. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1541. <parameters command="PBSZ 0"/>
  1542. </event>
  1543.  
  1544. <event seq="224" time="2019-02-11 08:11:54.826384 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1545. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1546. <parameters reply="200 PBSZ=0"/>
  1547. </event>
  1548.  
  1549. <event seq="225" time="2019-02-11 08:11:54.840334 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1550. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1551. <parameters command="PROT P"/>
  1552. </event>
  1553.  
  1554. <event seq="226" time="2019-02-11 08:11:54.840361 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1555. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1556. <parameters reply="200 Data protection level set to Private"/>
  1557. </event>
  1558.  
  1559. <event seq="227" time="2019-02-11 08:11:54.856400 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1560. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1561. <parameters command="PWD"/>
  1562. </event>
  1563.  
  1564. <event seq="228" time="2019-02-11 08:11:54.856431 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1565. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1566. <parameters reply="257 &quot;/&quot; is current directory"/>
  1567. </event>
  1568.  
  1569. <event seq="229" time="2019-02-11 08:11:54.872362 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1570. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1571. <parameters command="TYPE I"/>
  1572. </event>
  1573.  
  1574. <event seq="230" time="2019-02-11 08:11:54.872406 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1575. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1576. <parameters reply="200 Representation type set to Image"/>
  1577. </event>
  1578.  
  1579. <event seq="231" time="2019-02-11 08:11:54.886375 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1580. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1581. <parameters command="PASV"/>
  1582. </event>
  1583.  
  1584. <event seq="232" time="2019-02-11 08:11:54.886521 -0700" app="BvSshServer 8.24" name="T_FTP_DATA_ACCEPT_STARTED" desc="Passive FTP data connection attempt started.">
  1585. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1586. <parameters listenAddress="0.0.0.0:49225" replyAddress="0.0.0.0:49225"/>
  1587. </event>
  1588.  
  1589. <event seq="233" time="2019-02-11 08:11:54.886587 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1590. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1591. <parameters reply="227 Entering Passive Mode (0,0,0,0,192,73)"/>
  1592. </event>
  1593.  
  1594. <event seq="234" time="2019-02-11 08:11:54.900349 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1595. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1596. <parameters command="LIST"/>
  1597. </event>
  1598.  
  1599. <event seq="235" time="2019-02-11 08:11:54.901267 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  1600. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1601. <sfs moduleName="FlowSfsRoot" code="26904" desc="Paths processed.">
  1602. <parameters pathRaw="/" path="/"/>
  1603. <handler moduleName="FlowSfsWin" mountPath="/"/>
  1604. </sfs>
  1605. </event>
  1606.  
  1607. <event seq="236" time="2019-02-11 08:11:54.901300 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  1608. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1609. <sfs moduleName="FlowSfsWin" mountPath="/" code="11000" desc="Initializing module succeeded."/>
  1610. </event>
  1611.  
  1612. <event seq="237" time="2019-02-11 08:11:54.901377 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  1613. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1614. <sfs moduleName="FlowSfsWin" mountPath="/" code="26000" desc="Opening directory succeeded.">
  1615. <parameters path="C:\Share"/>
  1616. </sfs>
  1617. </event>
  1618.  
  1619. <event seq="238" time="2019-02-11 08:11:54.902066 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1620. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1621. <parameters reply="150 Opening data connection"/>
  1622. </event>
  1623.  
  1624. <event seq="239" time="2019-02-11 08:12:14.957418 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_EOF_RECEIVED" desc="Received EOF on FTP control connection.">
  1625. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1626. <parameters eofType="SocketEof"/>
  1627. </event>
  1628.  
  1629. <event seq="240" time="2019-02-11 08:12:14.965290 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  1630. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1631. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  1632. <parameters path="C:\Share" type="Directory" how="ByCleanup"/>
  1633. </sfs>
  1634. </event>
  1635.  
  1636. <event seq="241" time="2019-02-11 08:12:14.967917 -0700" app="BvSshServer 8.24" name="I_SESSION_DISCONNECTED_NORMALLY" desc="Session disconnected normally.">
  1637. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1638. <parameters disconnectReason="EndOfSession" socketBytesReceived="1176" socketBytesSent="2532" payloadBytesReceived="114" payloadBytesSent="595"/>
  1639. <sessions ssh="1" sshAuth="1" ftp="0" ftpAuth="0"/>
  1640. <help message="The session has ended normally."/>
  1641. </event>
  1642.  
  1643. <event seq="242" time="2019-02-11 08:12:14.967963 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_NO_PROCESS_HANDLE" desc="No process handle supplied.">
  1644. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1645. <parameters processFrom="OnLogonCommand"/>
  1646. </event>
  1647.  
  1648. <event seq="243" time="2019-02-11 08:12:14.967978 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_NO_PROCESS_HANDLE" desc="No process handle supplied.">
  1649. <session id="1008" service="FTP" remoteAddress="8.8.8.8:51295" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1650. <parameters processFrom="OnLogoffCommand"/>
  1651. </event>
  1652.  
  1653. <event seq="244" time="2019-02-11 08:12:14.968981 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_PROCESS_COMPLETED" desc="Process completed; terminating job.">
  1654. <parameters processFrom="FtpSession" exitCode="0"/>
  1655. </event>
  1656.  
  1657. <event seq="245" time="2019-02-11 08:12:15.040746 -0700" app="BvSshServer 8.24" name="I_CONNECT_ACCEPTED" desc="Connection accepted.">
  1658. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA"/>
  1659. <location continent="North America" country="Canada"/>
  1660. <parameters addressRule="AnyIP" listenAddress="192.168.0.2:21"/>
  1661. <sessions ssh="1" sshAuth="1" ftp="1" ftpAuth="0"/>
  1662. </event>
  1663.  
  1664. <event seq="246" time="2019-02-11 08:12:15.041116 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1665. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA"/>
  1666. <parameters reply="220 Bitvise SSH Server 8.24"/>
  1667. </event>
  1668.  
  1669. <event seq="247" time="2019-02-11 08:12:15.058540 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1670. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA"/>
  1671. <parameters command="AUTH TLS"/>
  1672. </event>
  1673.  
  1674. <event seq="248" time="2019-02-11 08:12:15.058587 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1675. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA"/>
  1676. <parameters reply="234 Security mechanism set to TLS"/>
  1677. </event>
  1678.  
  1679. <event seq="249" time="2019-02-11 08:12:15.138881 -0700" app="BvSshServer 8.24" name="I_FTP_CONTROL_TLS_NEGOTIATED" desc="TLS algorithms for FTP control connection negotiated.">
  1680. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA"/>
  1681. <parameters negNr="1" protocol="TLS 1.2" cipherSuite="TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256"/>
  1682. </event>
  1683.  
  1684. <event seq="250" time="2019-02-11 08:12:15.160353 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1685. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA"/>
  1686. <parameters command="USER testuser"/>
  1687. </event>
  1688.  
  1689. <event seq="251" time="2019-02-11 08:12:15.160418 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1690. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA"/>
  1691. <parameters reply="331 Need password"/>
  1692. </event>
  1693.  
  1694. <event seq="252" time="2019-02-11 08:12:15.174315 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1695. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA"/>
  1696. <parameters command="PASS ***"/>
  1697. </event>
  1698.  
  1699. <event seq="253" time="2019-02-11 08:12:15.174350 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_ATTEMPT_STARTED" desc="User authentication attempt started.">
  1700. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA"/>
  1701. <authentication attemptNr="1" userName="testuser" method="password"/>
  1702. </event>
  1703.  
  1704. <event seq="254" time="2019-02-11 08:12:15.202287 -0700" app="BvSshServer 8.24" name="T_LOGON_PROCEDURE_TIMING" desc="Logon procedure timing.">
  1705. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA"/>
  1706. <parameters procedure="LogonUser()" timerMs="1"/>
  1707. </event>
  1708.  
  1709. <event seq="255" time="2019-02-11 08:12:15.202336 -0700" app="BvSshServer 8.24" name="T_LOGON_TOKEN_ELEVATION_CHANGE_FAILED" desc="Could not change or obtain user token elevation state.">
  1710. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA"/>
  1711. <parameters desiredElevation="Yes" failureReason="LinkedTokenNotAvailable"/>
  1712. <help message="Elevation state cannot be changed for sessions with the 'network' logon type."/>
  1713. </event>
  1714.  
  1715. <event seq="256" time="2019-02-11 08:12:15.213224 -0700" app="BvSshServer 8.24" name="T_LOGON_PROCEDURE_TIMING" desc="Logon procedure timing.">
  1716. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA"/>
  1717. <parameters procedure="NetUserGetInfo()" timerMs="10"/>
  1718. </event>
  1719.  
  1720. <event seq="257" time="2019-02-11 08:12:15.213787 -0700" app="BvSshServer 8.24" name="I_LOGON_AUTH_SUCCEEDED" desc="User authentication succeeded.">
  1721. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1722. <authentication attemptNr="1" serialize="completion" userName="testuser" method="password"/>
  1723. <parameters accountSettings="testuser" groupSettings="Virtual Users" tokenType="LogonUser" tokenLogonType="Network" tokenElevation="Restricted"/>
  1724. </event>
  1725.  
  1726. <event seq="258" time="2019-02-11 08:12:15.213891 -0700" app="BvSshServer 8.24" name="T_LOGON_HOME_DIRECTORY_RETRIEVE_ERROR" desc="Error retrieving home directory.">
  1727. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1728. <error type="WinApi" operation="GetUserProfileDirectory()" code="2" message="The system cannot find the file specified."/>
  1729. </event>
  1730.  
  1731. <event seq="259" time="2019-02-11 08:12:15.214779 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_ATTEMPT_ENDED" desc="User authentication attempt ended.">
  1732. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1733. <authentication attemptNr="1" serialize="completion" userName="testuser" method="password"/>
  1734. </event>
  1735.  
  1736. <event seq="260" time="2019-02-11 08:12:15.214819 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1737. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1738. <parameters reply="230 User logged in"/>
  1739. </event>
  1740.  
  1741. <event seq="261" time="2019-02-11 08:12:15.219258 -0700" app="BvSshServer 8.24" name="T_SUBSYS_EXECUTED" desc="SSH server subsystem executed.">
  1742. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1743. <parameters exeFile="SfsServer.exe"/>
  1744. </event>
  1745.  
  1746. <event seq="262" time="2019-02-11 08:12:15.236102 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  1747. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1748. <sfs moduleName="FlowSfsRoot" code="11901" desc="Initializing module with the following settings.">
  1749. <parameters
  1750. settings="Root
  1751. HomePath=/
  1752. CreateHome=No
  1753. ShowRelative=Yes
  1754. DelayInit=Yes
  1755. Provider=FlowSfsWin
  1756. MountPath=/
  1757. MountMode=List,ReadExist,WriteExist,ReadWriteDeleteNew,CreateDir,CreateLink
  1758. RootPath=C:\Share
  1759. CreateRoot=No
  1760. MaxPathLength=3000
  1761. DelayInit=Yes
  1762. ShowEmptyDir=IfNoAccess
  1763. FileShareBeh=Default
  1764. FileShare=Read,Write
  1765. OwnerGroup=IfUnknown-Default
  1766. Acl=IfUnknownAce-DefaultAcl"/>
  1767. </sfs>
  1768. </event>
  1769.  
  1770. <event seq="263" time="2019-02-11 08:12:15.236150 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  1771. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1772. <sfs moduleName="FlowSfsRoot" code="11000" desc="Initializing module succeeded."/>
  1773. </event>
  1774.  
  1775. <event seq="264" time="2019-02-11 08:12:15.236166 -0700" app="BvSshServer 8.24" name="I_SFS_QUERY_HOME_DIRECTORY" desc="Virtual filesystem: query home directory.">
  1776. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1777. <sfs moduleName="FlowSfsRoot" code="40000" desc="Querying home directory succeeded.">
  1778. <parameters homePath="/"/>
  1779. </sfs>
  1780. </event>
  1781.  
  1782. <event seq="265" time="2019-02-11 08:12:15.236236 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1783. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1784. <parameters command="OPTS UTF8 ON"/>
  1785. </event>
  1786.  
  1787. <event seq="266" time="2019-02-11 08:12:15.236263 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1788. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1789. <parameters reply="202 The UTF8 option is already enabled"/>
  1790. </event>
  1791.  
  1792. <event seq="267" time="2019-02-11 08:12:15.250331 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1793. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1794. <parameters command="PBSZ 0"/>
  1795. </event>
  1796.  
  1797. <event seq="268" time="2019-02-11 08:12:15.250364 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1798. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1799. <parameters reply="200 PBSZ=0"/>
  1800. </event>
  1801.  
  1802. <event seq="269" time="2019-02-11 08:12:15.267406 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1803. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1804. <parameters command="PROT P"/>
  1805. </event>
  1806.  
  1807. <event seq="270" time="2019-02-11 08:12:15.267439 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1808. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1809. <parameters reply="200 Data protection level set to Private"/>
  1810. </event>
  1811.  
  1812. <event seq="271" time="2019-02-11 08:12:15.294290 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1813. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1814. <parameters command="PWD"/>
  1815. </event>
  1816.  
  1817. <event seq="272" time="2019-02-11 08:12:15.294328 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1818. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1819. <parameters reply="257 &quot;/&quot; is current directory"/>
  1820. </event>
  1821.  
  1822. <event seq="273" time="2019-02-11 08:12:15.308287 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1823. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1824. <parameters command="TYPE I"/>
  1825. </event>
  1826.  
  1827. <event seq="274" time="2019-02-11 08:12:15.308331 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1828. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1829. <parameters reply="200 Representation type set to Image"/>
  1830. </event>
  1831.  
  1832. <event seq="275" time="2019-02-11 08:12:15.326349 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1833. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1834. <parameters command="PASV"/>
  1835. </event>
  1836.  
  1837. <event seq="276" time="2019-02-11 08:12:15.326502 -0700" app="BvSshServer 8.24" name="T_FTP_DATA_ACCEPT_STARTED" desc="Passive FTP data connection attempt started.">
  1838. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1839. <parameters listenAddress="0.0.0.0:49225" replyAddress="0.0.0.0:49225"/>
  1840. </event>
  1841.  
  1842. <event seq="277" time="2019-02-11 08:12:15.326575 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1843. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1844. <parameters reply="227 Entering Passive Mode (0,0,0,0,192,73)"/>
  1845. </event>
  1846.  
  1847. <event seq="278" time="2019-02-11 08:12:15.341802 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1848. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1849. <parameters command="LIST"/>
  1850. </event>
  1851.  
  1852. <event seq="279" time="2019-02-11 08:12:15.342763 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  1853. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1854. <sfs moduleName="FlowSfsRoot" code="26904" desc="Paths processed.">
  1855. <parameters pathRaw="/" path="/"/>
  1856. <handler moduleName="FlowSfsWin" mountPath="/"/>
  1857. </sfs>
  1858. </event>
  1859.  
  1860. <event seq="280" time="2019-02-11 08:12:15.342804 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  1861. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1862. <sfs moduleName="FlowSfsWin" mountPath="/" code="11000" desc="Initializing module succeeded."/>
  1863. </event>
  1864.  
  1865. <event seq="281" time="2019-02-11 08:12:15.342933 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  1866. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1867. <sfs moduleName="FlowSfsWin" mountPath="/" code="26000" desc="Opening directory succeeded.">
  1868. <parameters path="C:\Share"/>
  1869. </sfs>
  1870. </event>
  1871.  
  1872. <event seq="282" time="2019-02-11 08:12:15.343009 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1873. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1874. <parameters reply="150 Opening data connection"/>
  1875. </event>
  1876.  
  1877. <event seq="283" time="2019-02-11 08:12:35.494364 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_EOF_RECEIVED" desc="Received EOF on FTP control connection.">
  1878. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1879. <parameters eofType="SocketEof"/>
  1880. </event>
  1881.  
  1882. <event seq="284" time="2019-02-11 08:12:35.497566 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  1883. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1884. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  1885. <parameters path="C:\Share" type="Directory" how="ByCleanup"/>
  1886. </sfs>
  1887. </event>
  1888.  
  1889. <event seq="285" time="2019-02-11 08:12:35.499758 -0700" app="BvSshServer 8.24" name="I_SESSION_DISCONNECTED_NORMALLY" desc="Session disconnected normally.">
  1890. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1891. <parameters disconnectReason="EndOfSession" socketBytesReceived="1070" socketBytesSent="2122" payloadBytesReceived="102" payloadBytesSent="274"/>
  1892. <sessions ssh="1" sshAuth="1" ftp="0" ftpAuth="0"/>
  1893. <help message="The session has ended normally."/>
  1894. </event>
  1895.  
  1896. <event seq="286" time="2019-02-11 08:12:35.499804 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_NO_PROCESS_HANDLE" desc="No process handle supplied.">
  1897. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1898. <parameters processFrom="OnLogonCommand"/>
  1899. </event>
  1900.  
  1901. <event seq="287" time="2019-02-11 08:12:35.499819 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_NO_PROCESS_HANDLE" desc="No process handle supplied.">
  1902. <session id="1009" service="FTP" remoteAddress="8.8.8.8:51298" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1903. <parameters processFrom="OnLogoffCommand"/>
  1904. </event>
  1905.  
  1906. <event seq="288" time="2019-02-11 08:12:35.500271 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_PROCESS_COMPLETED" desc="Process completed; terminating job.">
  1907. <parameters processFrom="FtpSession" exitCode="0"/>
  1908. </event>
  1909.  
  1910. <event seq="289" time="2019-02-11 08:14:18.925741 -0700" app="BvSshServer 8.24" name="I_CONNECT_ACCEPTED" desc="Connection accepted.">
  1911. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA"/>
  1912. <location continent="North America" country="Canada"/>
  1913. <parameters addressRule="AnyIP" listenAddress="192.168.0.2:21"/>
  1914. <sessions ssh="1" sshAuth="1" ftp="1" ftpAuth="0"/>
  1915. </event>
  1916.  
  1917. <event seq="290" time="2019-02-11 08:14:18.926088 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1918. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA"/>
  1919. <parameters reply="220 Bitvise SSH Server 8.24"/>
  1920. </event>
  1921.  
  1922. <event seq="291" time="2019-02-11 08:14:18.946239 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1923. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA"/>
  1924. <parameters command="AUTH TLS"/>
  1925. </event>
  1926.  
  1927. <event seq="292" time="2019-02-11 08:14:18.946277 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1928. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA"/>
  1929. <parameters reply="234 Security mechanism set to TLS"/>
  1930. </event>
  1931.  
  1932. <event seq="293" time="2019-02-11 08:14:19.128770 -0700" app="BvSshServer 8.24" name="I_FTP_CONTROL_TLS_NEGOTIATED" desc="TLS algorithms for FTP control connection negotiated.">
  1933. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA"/>
  1934. <parameters negNr="1" protocol="TLS 1.2" cipherSuite="TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256"/>
  1935. </event>
  1936.  
  1937. <event seq="294" time="2019-02-11 08:14:19.167358 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1938. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA"/>
  1939. <parameters command="USER testuser"/>
  1940. </event>
  1941.  
  1942. <event seq="295" time="2019-02-11 08:14:19.167402 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1943. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA"/>
  1944. <parameters reply="331 Need password"/>
  1945. </event>
  1946.  
  1947. <event seq="296" time="2019-02-11 08:14:19.187780 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  1948. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA"/>
  1949. <parameters command="PASS ***"/>
  1950. </event>
  1951.  
  1952. <event seq="297" time="2019-02-11 08:14:19.187814 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_ATTEMPT_STARTED" desc="User authentication attempt started.">
  1953. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA"/>
  1954. <authentication attemptNr="1" userName="testuser" method="password"/>
  1955. </event>
  1956.  
  1957. <event seq="298" time="2019-02-11 08:14:19.216524 -0700" app="BvSshServer 8.24" name="T_LOGON_PROCEDURE_TIMING" desc="Logon procedure timing.">
  1958. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA"/>
  1959. <parameters procedure="LogonUser()" timerMs="2"/>
  1960. </event>
  1961.  
  1962. <event seq="299" time="2019-02-11 08:14:19.216562 -0700" app="BvSshServer 8.24" name="T_LOGON_TOKEN_ELEVATION_CHANGE_FAILED" desc="Could not change or obtain user token elevation state.">
  1963. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA"/>
  1964. <parameters desiredElevation="Yes" failureReason="LinkedTokenNotAvailable"/>
  1965. <help message="Elevation state cannot be changed for sessions with the 'network' logon type."/>
  1966. </event>
  1967.  
  1968. <event seq="300" time="2019-02-11 08:14:19.223000 -0700" app="BvSshServer 8.24" name="T_LOGON_PROCEDURE_TIMING" desc="Logon procedure timing.">
  1969. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA"/>
  1970. <parameters procedure="NetUserGetInfo()" timerMs="6"/>
  1971. </event>
  1972.  
  1973. <event seq="301" time="2019-02-11 08:14:19.223582 -0700" app="BvSshServer 8.24" name="I_LOGON_AUTH_SUCCEEDED" desc="User authentication succeeded.">
  1974. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1975. <authentication attemptNr="1" serialize="completion" userName="testuser" method="password"/>
  1976. <parameters accountSettings="testuser" groupSettings="Virtual Users" tokenType="LogonUser" tokenLogonType="Network" tokenElevation="Restricted"/>
  1977. </event>
  1978.  
  1979. <event seq="302" time="2019-02-11 08:14:19.223690 -0700" app="BvSshServer 8.24" name="T_LOGON_HOME_DIRECTORY_RETRIEVE_ERROR" desc="Error retrieving home directory.">
  1980. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1981. <error type="WinApi" operation="GetUserProfileDirectory()" code="2" message="The system cannot find the file specified."/>
  1982. </event>
  1983.  
  1984. <event seq="303" time="2019-02-11 08:14:19.224517 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_ATTEMPT_ENDED" desc="User authentication attempt ended.">
  1985. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1986. <authentication attemptNr="1" serialize="completion" userName="testuser" method="password"/>
  1987. </event>
  1988.  
  1989. <event seq="304" time="2019-02-11 08:14:19.224548 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  1990. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1991. <parameters reply="230 User logged in"/>
  1992. </event>
  1993.  
  1994. <event seq="305" time="2019-02-11 08:14:19.229269 -0700" app="BvSshServer 8.24" name="T_SUBSYS_EXECUTED" desc="SSH server subsystem executed.">
  1995. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  1996. <parameters exeFile="SfsServer.exe"/>
  1997. </event>
  1998.  
  1999. <event seq="306" time="2019-02-11 08:14:19.246818 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  2000. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2001. <sfs moduleName="FlowSfsRoot" code="11901" desc="Initializing module with the following settings.">
  2002. <parameters
  2003. settings="Root
  2004. HomePath=/
  2005. CreateHome=No
  2006. ShowRelative=Yes
  2007. DelayInit=Yes
  2008. Provider=FlowSfsWin
  2009. MountPath=/
  2010. MountMode=List,ReadExist,WriteExist,ReadWriteDeleteNew,CreateDir,CreateLink
  2011. RootPath=C:\Share
  2012. CreateRoot=No
  2013. MaxPathLength=3000
  2014. DelayInit=Yes
  2015. ShowEmptyDir=IfNoAccess
  2016. FileShareBeh=Default
  2017. FileShare=Read,Write
  2018. OwnerGroup=IfUnknown-Default
  2019. Acl=IfUnknownAce-DefaultAcl"/>
  2020. </sfs>
  2021. </event>
  2022.  
  2023. <event seq="307" time="2019-02-11 08:14:19.246873 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  2024. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2025. <sfs moduleName="FlowSfsRoot" code="11000" desc="Initializing module succeeded."/>
  2026. </event>
  2027.  
  2028. <event seq="308" time="2019-02-11 08:14:19.246890 -0700" app="BvSshServer 8.24" name="I_SFS_QUERY_HOME_DIRECTORY" desc="Virtual filesystem: query home directory.">
  2029. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2030. <sfs moduleName="FlowSfsRoot" code="40000" desc="Querying home directory succeeded.">
  2031. <parameters homePath="/"/>
  2032. </sfs>
  2033. </event>
  2034.  
  2035. <event seq="309" time="2019-02-11 08:14:19.252334 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2036. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2037. <parameters command="OPTS UTF8 ON"/>
  2038. </event>
  2039.  
  2040. <event seq="310" time="2019-02-11 08:14:19.252371 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2041. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2042. <parameters reply="202 The UTF8 option is already enabled"/>
  2043. </event>
  2044.  
  2045. <event seq="311" time="2019-02-11 08:14:19.266721 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2046. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2047. <parameters command="PBSZ 0"/>
  2048. </event>
  2049.  
  2050. <event seq="312" time="2019-02-11 08:14:19.266748 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2051. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2052. <parameters reply="200 PBSZ=0"/>
  2053. </event>
  2054.  
  2055. <event seq="313" time="2019-02-11 08:14:19.286343 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2056. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2057. <parameters command="PROT P"/>
  2058. </event>
  2059.  
  2060. <event seq="314" time="2019-02-11 08:14:19.286376 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2061. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2062. <parameters reply="200 Data protection level set to Private"/>
  2063. </event>
  2064.  
  2065. <event seq="315" time="2019-02-11 08:14:19.309311 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2066. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2067. <parameters command="PWD"/>
  2068. </event>
  2069.  
  2070. <event seq="316" time="2019-02-11 08:14:19.309341 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2071. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2072. <parameters reply="257 &quot;/&quot; is current directory"/>
  2073. </event>
  2074.  
  2075. <event seq="317" time="2019-02-11 08:14:19.330299 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2076. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2077. <parameters command="TYPE I"/>
  2078. </event>
  2079.  
  2080. <event seq="318" time="2019-02-11 08:14:19.330336 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2081. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2082. <parameters reply="200 Representation type set to Image"/>
  2083. </event>
  2084.  
  2085. <event seq="319" time="2019-02-11 08:14:19.350306 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2086. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2087. <parameters command="PASV"/>
  2088. </event>
  2089.  
  2090. <event seq="320" time="2019-02-11 08:14:19.350452 -0700" app="BvSshServer 8.24" name="T_FTP_DATA_ACCEPT_STARTED" desc="Passive FTP data connection attempt started.">
  2091. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2092. <parameters listenAddress="0.0.0.0:49225" replyAddress="0.0.0.0:49225"/>
  2093. </event>
  2094.  
  2095. <event seq="321" time="2019-02-11 08:14:19.350517 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2096. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2097. <parameters reply="227 Entering Passive Mode (0,0,0,0,192,73)"/>
  2098. </event>
  2099.  
  2100. <event seq="322" time="2019-02-11 08:14:19.373330 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2101. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2102. <parameters command="LIST"/>
  2103. </event>
  2104.  
  2105. <event seq="323" time="2019-02-11 08:14:19.374255 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  2106. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2107. <sfs moduleName="FlowSfsRoot" code="26904" desc="Paths processed.">
  2108. <parameters pathRaw="/" path="/"/>
  2109. <handler moduleName="FlowSfsWin" mountPath="/"/>
  2110. </sfs>
  2111. </event>
  2112.  
  2113. <event seq="324" time="2019-02-11 08:14:19.374295 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  2114. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2115. <sfs moduleName="FlowSfsWin" mountPath="/" code="11000" desc="Initializing module succeeded."/>
  2116. </event>
  2117.  
  2118. <event seq="325" time="2019-02-11 08:14:19.374449 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  2119. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2120. <sfs moduleName="FlowSfsWin" mountPath="/" code="26000" desc="Opening directory succeeded.">
  2121. <parameters path="C:\Share"/>
  2122. </sfs>
  2123. </event>
  2124.  
  2125. <event seq="326" time="2019-02-11 08:14:19.374530 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2126. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2127. <parameters reply="150 Opening data connection"/>
  2128. </event>
  2129.  
  2130. <event seq="327" time="2019-02-11 08:14:39.209367 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_EOF_RECEIVED" desc="Received EOF on FTP control connection.">
  2131. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2132. <parameters eofType="SocketEof"/>
  2133. </event>
  2134.  
  2135. <event seq="328" time="2019-02-11 08:14:39.212498 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  2136. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2137. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  2138. <parameters path="C:\Share" type="Directory" how="ByCleanup"/>
  2139. </sfs>
  2140. </event>
  2141.  
  2142. <event seq="329" time="2019-02-11 08:14:39.214714 -0700" app="BvSshServer 8.24" name="I_SESSION_DISCONNECTED_NORMALLY" desc="Session disconnected normally.">
  2143. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2144. <parameters disconnectReason="EndOfSession" socketBytesReceived="1070" socketBytesSent="2122" payloadBytesReceived="102" payloadBytesSent="274"/>
  2145. <sessions ssh="1" sshAuth="1" ftp="0" ftpAuth="0"/>
  2146. <help message="The session has ended normally."/>
  2147. </event>
  2148.  
  2149. <event seq="330" time="2019-02-11 08:14:39.214763 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_NO_PROCESS_HANDLE" desc="No process handle supplied.">
  2150. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2151. <parameters processFrom="OnLogonCommand"/>
  2152. </event>
  2153.  
  2154. <event seq="331" time="2019-02-11 08:14:39.214778 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_NO_PROCESS_HANDLE" desc="No process handle supplied.">
  2155. <session id="1010" service="FTP" remoteAddress="8.8.8.8:51304" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2156. <parameters processFrom="OnLogoffCommand"/>
  2157. </event>
  2158.  
  2159. <event seq="332" time="2019-02-11 08:14:39.215316 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_PROCESS_COMPLETED" desc="Process completed; terminating job.">
  2160. <parameters processFrom="FtpSession" exitCode="0"/>
  2161. </event>
  2162.  
  2163. <event seq="333" time="2019-02-11 08:14:39.342706 -0700" app="BvSshServer 8.24" name="I_CONNECT_ACCEPTED" desc="Connection accepted.">
  2164. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA"/>
  2165. <location continent="North America" country="Canada"/>
  2166. <parameters addressRule="AnyIP" listenAddress="192.168.0.2:21"/>
  2167. <sessions ssh="1" sshAuth="1" ftp="1" ftpAuth="0"/>
  2168. </event>
  2169.  
  2170. <event seq="334" time="2019-02-11 08:14:39.343079 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2171. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA"/>
  2172. <parameters reply="220 Bitvise SSH Server 8.24"/>
  2173. </event>
  2174.  
  2175. <event seq="335" time="2019-02-11 08:14:39.367204 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2176. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA"/>
  2177. <parameters command="AUTH TLS"/>
  2178. </event>
  2179.  
  2180. <event seq="336" time="2019-02-11 08:14:39.367255 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2181. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA"/>
  2182. <parameters reply="234 Security mechanism set to TLS"/>
  2183. </event>
  2184.  
  2185. <event seq="337" time="2019-02-11 08:14:39.551659 -0700" app="BvSshServer 8.24" name="I_FTP_CONTROL_TLS_NEGOTIATED" desc="TLS algorithms for FTP control connection negotiated.">
  2186. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA"/>
  2187. <parameters negNr="1" protocol="TLS 1.2" cipherSuite="TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256"/>
  2188. </event>
  2189.  
  2190. <event seq="338" time="2019-02-11 08:14:39.569241 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2191. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA"/>
  2192. <parameters command="USER testuser"/>
  2193. </event>
  2194.  
  2195. <event seq="339" time="2019-02-11 08:14:39.569288 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2196. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA"/>
  2197. <parameters reply="331 Need password"/>
  2198. </event>
  2199.  
  2200. <event seq="340" time="2019-02-11 08:14:39.583226 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2201. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA"/>
  2202. <parameters command="PASS ***"/>
  2203. </event>
  2204.  
  2205. <event seq="341" time="2019-02-11 08:14:39.583258 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_ATTEMPT_STARTED" desc="User authentication attempt started.">
  2206. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA"/>
  2207. <authentication attemptNr="1" userName="testuser" method="password"/>
  2208. </event>
  2209.  
  2210. <event seq="342" time="2019-02-11 08:14:39.611588 -0700" app="BvSshServer 8.24" name="T_LOGON_PROCEDURE_TIMING" desc="Logon procedure timing.">
  2211. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA"/>
  2212. <parameters procedure="LogonUser()" timerMs="1"/>
  2213. </event>
  2214.  
  2215. <event seq="343" time="2019-02-11 08:14:39.611629 -0700" app="BvSshServer 8.24" name="T_LOGON_TOKEN_ELEVATION_CHANGE_FAILED" desc="Could not change or obtain user token elevation state.">
  2216. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA"/>
  2217. <parameters desiredElevation="Yes" failureReason="LinkedTokenNotAvailable"/>
  2218. <help message="Elevation state cannot be changed for sessions with the 'network' logon type."/>
  2219. </event>
  2220.  
  2221. <event seq="344" time="2019-02-11 08:14:39.624459 -0700" app="BvSshServer 8.24" name="T_LOGON_PROCEDURE_TIMING" desc="Logon procedure timing.">
  2222. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA"/>
  2223. <parameters procedure="NetUserGetInfo()" timerMs="12"/>
  2224. </event>
  2225.  
  2226. <event seq="345" time="2019-02-11 08:14:39.625005 -0700" app="BvSshServer 8.24" name="I_LOGON_AUTH_SUCCEEDED" desc="User authentication succeeded.">
  2227. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2228. <authentication attemptNr="1" serialize="completion" userName="testuser" method="password"/>
  2229. <parameters accountSettings="testuser" groupSettings="Virtual Users" tokenType="LogonUser" tokenLogonType="Network" tokenElevation="Restricted"/>
  2230. </event>
  2231.  
  2232. <event seq="346" time="2019-02-11 08:14:39.625114 -0700" app="BvSshServer 8.24" name="T_LOGON_HOME_DIRECTORY_RETRIEVE_ERROR" desc="Error retrieving home directory.">
  2233. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2234. <error type="WinApi" operation="GetUserProfileDirectory()" code="2" message="The system cannot find the file specified."/>
  2235. </event>
  2236.  
  2237. <event seq="347" time="2019-02-11 08:14:39.626012 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_ATTEMPT_ENDED" desc="User authentication attempt ended.">
  2238. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2239. <authentication attemptNr="1" serialize="completion" userName="testuser" method="password"/>
  2240. </event>
  2241.  
  2242. <event seq="348" time="2019-02-11 08:14:39.626061 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2243. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2244. <parameters reply="230 User logged in"/>
  2245. </event>
  2246.  
  2247. <event seq="349" time="2019-02-11 08:14:39.630606 -0700" app="BvSshServer 8.24" name="T_SUBSYS_EXECUTED" desc="SSH server subsystem executed.">
  2248. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2249. <parameters exeFile="SfsServer.exe"/>
  2250. </event>
  2251.  
  2252. <event seq="350" time="2019-02-11 08:14:39.647904 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  2253. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2254. <sfs moduleName="FlowSfsRoot" code="11901" desc="Initializing module with the following settings.">
  2255. <parameters
  2256. settings="Root
  2257. HomePath=/
  2258. CreateHome=No
  2259. ShowRelative=Yes
  2260. DelayInit=Yes
  2261. Provider=FlowSfsWin
  2262. MountPath=/
  2263. MountMode=List,ReadExist,WriteExist,ReadWriteDeleteNew,CreateDir,CreateLink
  2264. RootPath=C:\Share
  2265. CreateRoot=No
  2266. MaxPathLength=3000
  2267. DelayInit=Yes
  2268. ShowEmptyDir=IfNoAccess
  2269. FileShareBeh=Default
  2270. FileShare=Read,Write
  2271. OwnerGroup=IfUnknown-Default
  2272. Acl=IfUnknownAce-DefaultAcl"/>
  2273. </sfs>
  2274. </event>
  2275.  
  2276. <event seq="351" time="2019-02-11 08:14:39.647957 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  2277. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2278. <sfs moduleName="FlowSfsRoot" code="11000" desc="Initializing module succeeded."/>
  2279. </event>
  2280.  
  2281. <event seq="352" time="2019-02-11 08:14:39.647976 -0700" app="BvSshServer 8.24" name="I_SFS_QUERY_HOME_DIRECTORY" desc="Virtual filesystem: query home directory.">
  2282. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2283. <sfs moduleName="FlowSfsRoot" code="40000" desc="Querying home directory succeeded.">
  2284. <parameters homePath="/"/>
  2285. </sfs>
  2286. </event>
  2287.  
  2288. <event seq="353" time="2019-02-11 08:14:39.648058 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2289. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2290. <parameters command="OPTS UTF8 ON"/>
  2291. </event>
  2292.  
  2293. <event seq="354" time="2019-02-11 08:14:39.648098 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2294. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2295. <parameters reply="202 The UTF8 option is already enabled"/>
  2296. </event>
  2297.  
  2298. <event seq="355" time="2019-02-11 08:14:39.662243 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2299. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2300. <parameters command="PBSZ 0"/>
  2301. </event>
  2302.  
  2303. <event seq="356" time="2019-02-11 08:14:39.662275 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2304. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2305. <parameters reply="200 PBSZ=0"/>
  2306. </event>
  2307.  
  2308. <event seq="357" time="2019-02-11 08:14:39.676236 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2309. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2310. <parameters command="PROT P"/>
  2311. </event>
  2312.  
  2313. <event seq="358" time="2019-02-11 08:14:39.676272 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2314. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2315. <parameters reply="200 Data protection level set to Private"/>
  2316. </event>
  2317.  
  2318. <event seq="359" time="2019-02-11 08:14:39.693269 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2319. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2320. <parameters command="PWD"/>
  2321. </event>
  2322.  
  2323. <event seq="360" time="2019-02-11 08:14:39.693322 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2324. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2325. <parameters reply="257 &quot;/&quot; is current directory"/>
  2326. </event>
  2327.  
  2328. <event seq="361" time="2019-02-11 08:14:39.707233 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2329. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2330. <parameters command="TYPE I"/>
  2331. </event>
  2332.  
  2333. <event seq="362" time="2019-02-11 08:14:39.707275 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2334. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2335. <parameters reply="200 Representation type set to Image"/>
  2336. </event>
  2337.  
  2338. <event seq="363" time="2019-02-11 08:14:39.721219 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2339. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2340. <parameters command="PASV"/>
  2341. </event>
  2342.  
  2343. <event seq="364" time="2019-02-11 08:14:39.721364 -0700" app="BvSshServer 8.24" name="T_FTP_DATA_ACCEPT_STARTED" desc="Passive FTP data connection attempt started.">
  2344. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2345. <parameters listenAddress="0.0.0.0:49225" replyAddress="0.0.0.0:49225"/>
  2346. </event>
  2347.  
  2348. <event seq="365" time="2019-02-11 08:14:39.721431 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2349. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2350. <parameters reply="227 Entering Passive Mode (0,0,0,0,192,73)"/>
  2351. </event>
  2352.  
  2353. <event seq="366" time="2019-02-11 08:14:39.736530 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2354. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2355. <parameters command="LIST"/>
  2356. </event>
  2357.  
  2358. <event seq="367" time="2019-02-11 08:14:39.737565 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  2359. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2360. <sfs moduleName="FlowSfsRoot" code="26904" desc="Paths processed.">
  2361. <parameters pathRaw="/" path="/"/>
  2362. <handler moduleName="FlowSfsWin" mountPath="/"/>
  2363. </sfs>
  2364. </event>
  2365.  
  2366. <event seq="368" time="2019-02-11 08:14:39.737617 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  2367. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2368. <sfs moduleName="FlowSfsWin" mountPath="/" code="11000" desc="Initializing module succeeded."/>
  2369. </event>
  2370.  
  2371. <event seq="369" time="2019-02-11 08:14:39.737695 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  2372. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2373. <sfs moduleName="FlowSfsWin" mountPath="/" code="26000" desc="Opening directory succeeded.">
  2374. <parameters path="C:\Share"/>
  2375. </sfs>
  2376. </event>
  2377.  
  2378. <event seq="370" time="2019-02-11 08:14:39.737781 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2379. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2380. <parameters reply="150 Opening data connection"/>
  2381. </event>
  2382.  
  2383. <event seq="371" time="2019-02-11 08:14:51.087439 -0700" app="BvSshServer 8.24" name="I_CONNECT_ACCEPTED" desc="Connection accepted.">
  2384. <session id="1012" service="FTP" remoteAddress="8.8.8.8:51309" loc="CA/NA"/>
  2385. <location continent="North America" country="Canada"/>
  2386. <parameters addressRule="AnyIP" listenAddress="192.168.0.2:21"/>
  2387. <sessions ssh="1" sshAuth="1" ftp="2" ftpAuth="1"/>
  2388. </event>
  2389.  
  2390. <event seq="372" time="2019-02-11 08:14:51.087927 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2391. <session id="1012" service="FTP" remoteAddress="8.8.8.8:51309" loc="CA/NA"/>
  2392. <parameters reply="220 Bitvise SSH Server 8.24"/>
  2393. </event>
  2394.  
  2395. <event seq="373" time="2019-02-11 08:14:51.088024 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2396. <session id="1012" service="FTP" remoteAddress="8.8.8.8:51309" loc="CA/NA"/>
  2397. <parameters command="????l???h??�P#�Ӗ��{?0�S:��p�`�??0� 0�ʙ��??:????????�,̩�"/>
  2398. </event>
  2399.  
  2400. <event seq="374" time="2019-02-11 08:14:51.088056 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2401. <session id="1012" service="FTP" remoteAddress="8.8.8.8:51309" loc="CA/NA"/>
  2402. <parameters reply="500 Unrecognized command"/>
  2403. </event>
  2404.  
  2405. <event seq="375" time="2019-02-11 08:14:51.088072 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2406. <session id="1012" service="FTP" remoteAddress="8.8.8.8:51309" loc="CA/NA"/>
  2407. <parameters command="���+� ���0̨�?�/�??�?5��?�?/��?�̪?9��?�?3��??????????????"/>
  2408. </event>
  2409.  
  2410. <event seq="376" time="2019-02-11 08:14:51.088091 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2411. <session id="1012" service="FTP" remoteAddress="8.8.8.8:51309" loc="CA/NA"/>
  2412. <parameters reply="500 Unrecognized command"/>
  2413. </event>
  2414.  
  2415. <event seq="377" time="2019-02-11 08:14:51.088104 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2416. <session id="1012" service="FTP" remoteAddress="8.8.8.8:51309" loc="CA/NA"/>
  2417. <parameters command="??????????????????????????????? ?????"/>
  2418. </event>
  2419.  
  2420. <event seq="378" time="2019-02-11 08:14:51.088130 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2421. <session id="1012" service="FTP" remoteAddress="8.8.8.8:51309" loc="CA/NA"/>
  2422. <parameters reply="500 Unrecognized command"/>
  2423. </event>
  2424.  
  2425. <event seq="379" time="2019-02-11 08:14:51.107107 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2426. <session id="1012" service="FTP" remoteAddress="8.8.8.8:51309" loc="CA/NA"/>
  2427. <parameters reply="421 Internal server error; see server's logs for details"/>
  2428. </event>
  2429.  
  2430. <event seq="380" time="2019-02-11 08:14:52.091709 -0700" app="BvSshServer 8.24" name="I_SESSION_DISCONNECTED_NORMALLY" desc="Session disconnected normally.">
  2431. <session id="1012" service="FTP" remoteAddress="8.8.8.8:51309" loc="CA/NA"/>
  2432. <parameters disconnectReason="Socket" socketBytesReceived="369" socketBytesSent="165" payloadBytesReceived="0" payloadBytesSent="0"/>
  2433. <error type="Flow" component="FtpManager/socketReader" class="WinApi" code="10054" message="An existing connection was forcibly closed by the remote host." description="FlowSocketReader: Error receiving bytes"/>
  2434. </event>
  2435.  
  2436. <event seq="381" time="2019-02-11 08:14:56.028441 -0700" app="BvSshServer 8.24" name="I_CONNECT_ACCEPTED" desc="Connection accepted.">
  2437. <session id="1013" service="FTP" remoteAddress="8.8.8.8:51310" loc="CA/NA"/>
  2438. <location continent="North America" country="Canada"/>
  2439. <parameters addressRule="AnyIP" listenAddress="192.168.0.2:21"/>
  2440. <sessions ssh="1" sshAuth="1" ftp="2" ftpAuth="1"/>
  2441. </event>
  2442.  
  2443. <event seq="382" time="2019-02-11 08:14:56.028835 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2444. <session id="1013" service="FTP" remoteAddress="8.8.8.8:51310" loc="CA/NA"/>
  2445. <parameters reply="220 Bitvise SSH Server 8.24"/>
  2446. </event>
  2447.  
  2448. <event seq="383" time="2019-02-11 08:14:56.028910 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2449. <session id="1013" service="FTP" remoteAddress="8.8.8.8:51310" loc="CA/NA"/>
  2450. <parameters command="????l???h??t���X^0a?�7�?�t�i?1�7,c��?�'�ײ??:????????�,̩�"/>
  2451. </event>
  2452.  
  2453. <event seq="384" time="2019-02-11 08:14:56.028938 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2454. <session id="1013" service="FTP" remoteAddress="8.8.8.8:51310" loc="CA/NA"/>
  2455. <parameters reply="500 Unrecognized command"/>
  2456. </event>
  2457.  
  2458. <event seq="385" time="2019-02-11 08:14:56.028953 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2459. <session id="1013" service="FTP" remoteAddress="8.8.8.8:51310" loc="CA/NA"/>
  2460. <parameters command="���+� ���0̨�?�/�??�?5��?�?/��?�̪?9��?�?3��??????????????"/>
  2461. </event>
  2462.  
  2463. <event seq="386" time="2019-02-11 08:14:56.028969 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2464. <session id="1013" service="FTP" remoteAddress="8.8.8.8:51310" loc="CA/NA"/>
  2465. <parameters reply="500 Unrecognized command"/>
  2466. </event>
  2467.  
  2468. <event seq="387" time="2019-02-11 08:14:56.028981 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2469. <session id="1013" service="FTP" remoteAddress="8.8.8.8:51310" loc="CA/NA"/>
  2470. <parameters command="??????????????????????????????? ?????"/>
  2471. </event>
  2472.  
  2473. <event seq="388" time="2019-02-11 08:14:56.028995 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2474. <session id="1013" service="FTP" remoteAddress="8.8.8.8:51310" loc="CA/NA"/>
  2475. <parameters reply="500 Unrecognized command"/>
  2476. </event>
  2477.  
  2478. <event seq="389" time="2019-02-11 08:14:56.029013 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2479. <session id="1013" service="FTP" remoteAddress="8.8.8.8:51310" loc="CA/NA"/>
  2480. <parameters command="??????????????? ???????????????????#???3?�?�???a?��ɑ��$e?��Y�ҩڢ?Ψ��NU�D�r��me���ۆ��_2�?��3g:77/}��-�;Bu"/>
  2481. </event>
  2482.  
  2483. <event seq="390" time="2019-02-11 08:14:56.029066 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2484. <session id="1013" service="FTP" remoteAddress="8.8.8.8:51310" loc="CA/NA"/>
  2485. <parameters reply="500 Unrecognized command"/>
  2486. </event>
  2487.  
  2488. <event seq="391" time="2019-02-11 08:14:56.029282 -0700" app="BvSshServer 8.24" name="I_CONNECT_ACCEPTED" desc="Connection accepted.">
  2489. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA"/>
  2490. <location continent="North America" country="Canada"/>
  2491. <parameters addressRule="AnyIP" listenAddress="192.168.0.2:21"/>
  2492. <sessions ssh="1" sshAuth="1" ftp="3" ftpAuth="1"/>
  2493. </event>
  2494.  
  2495. <event seq="392" time="2019-02-11 08:14:56.029602 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2496. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA"/>
  2497. <parameters reply="220 Bitvise SSH Server 8.24"/>
  2498. </event>
  2499.  
  2500. <event seq="393" time="2019-02-11 08:14:56.050443 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2501. <session id="1013" service="FTP" remoteAddress="8.8.8.8:51310" loc="CA/NA"/>
  2502. <parameters reply="421 Internal server error; see server's logs for details"/>
  2503. </event>
  2504.  
  2505. <event seq="394" time="2019-02-11 08:14:56.051129 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2506. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA"/>
  2507. <parameters command="AUTH TLS"/>
  2508. </event>
  2509.  
  2510. <event seq="395" time="2019-02-11 08:14:56.051168 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2511. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA"/>
  2512. <parameters reply="234 Security mechanism set to TLS"/>
  2513. </event>
  2514.  
  2515. <event seq="396" time="2019-02-11 08:14:56.125317 -0700" app="BvSshServer 8.24" name="I_FTP_CONTROL_TLS_NEGOTIATED" desc="TLS algorithms for FTP control connection negotiated.">
  2516. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA"/>
  2517. <parameters negNr="1" protocol="TLS 1.2" cipherSuite="TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256"/>
  2518. </event>
  2519.  
  2520. <event seq="397" time="2019-02-11 08:14:56.146930 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2521. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA"/>
  2522. <parameters command="USER testuser"/>
  2523. </event>
  2524.  
  2525. <event seq="398" time="2019-02-11 08:14:56.146976 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2526. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA"/>
  2527. <parameters reply="331 Need password"/>
  2528. </event>
  2529.  
  2530. <event seq="399" time="2019-02-11 08:14:56.166308 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2531. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA"/>
  2532. <parameters command="PASS ***"/>
  2533. </event>
  2534.  
  2535. <event seq="400" time="2019-02-11 08:14:56.166339 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_ATTEMPT_STARTED" desc="User authentication attempt started.">
  2536. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA"/>
  2537. <authentication attemptNr="1" userName="testuser" method="password"/>
  2538. </event>
  2539.  
  2540. <event seq="401" time="2019-02-11 08:14:56.194928 -0700" app="BvSshServer 8.24" name="T_LOGON_PROCEDURE_TIMING" desc="Logon procedure timing.">
  2541. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA"/>
  2542. <parameters procedure="LogonUser()" timerMs="2"/>
  2543. </event>
  2544.  
  2545. <event seq="402" time="2019-02-11 08:14:56.194964 -0700" app="BvSshServer 8.24" name="T_LOGON_TOKEN_ELEVATION_CHANGE_FAILED" desc="Could not change or obtain user token elevation state.">
  2546. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA"/>
  2547. <parameters desiredElevation="Yes" failureReason="LinkedTokenNotAvailable"/>
  2548. <help message="Elevation state cannot be changed for sessions with the 'network' logon type."/>
  2549. </event>
  2550.  
  2551. <event seq="403" time="2019-02-11 08:14:56.200848 -0700" app="BvSshServer 8.24" name="T_LOGON_PROCEDURE_TIMING" desc="Logon procedure timing.">
  2552. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA"/>
  2553. <parameters procedure="NetUserGetInfo()" timerMs="5"/>
  2554. </event>
  2555.  
  2556. <event seq="404" time="2019-02-11 08:14:56.201412 -0700" app="BvSshServer 8.24" name="I_LOGON_AUTH_SUCCEEDED" desc="User authentication succeeded.">
  2557. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2558. <authentication attemptNr="1" serialize="completion" userName="testuser" method="password"/>
  2559. <parameters accountSettings="testuser" groupSettings="Virtual Users" tokenType="LogonUser" tokenLogonType="Network" tokenElevation="Restricted"/>
  2560. </event>
  2561.  
  2562. <event seq="405" time="2019-02-11 08:14:56.201508 -0700" app="BvSshServer 8.24" name="T_LOGON_HOME_DIRECTORY_RETRIEVE_ERROR" desc="Error retrieving home directory.">
  2563. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2564. <error type="WinApi" operation="GetUserProfileDirectory()" code="2" message="The system cannot find the file specified."/>
  2565. </event>
  2566.  
  2567. <event seq="406" time="2019-02-11 08:14:56.202330 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_ATTEMPT_ENDED" desc="User authentication attempt ended.">
  2568. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2569. <authentication attemptNr="1" serialize="completion" userName="testuser" method="password"/>
  2570. </event>
  2571.  
  2572. <event seq="407" time="2019-02-11 08:14:56.202362 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2573. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2574. <parameters reply="230 User logged in"/>
  2575. </event>
  2576.  
  2577. <event seq="408" time="2019-02-11 08:14:56.207162 -0700" app="BvSshServer 8.24" name="T_SUBSYS_EXECUTED" desc="SSH server subsystem executed.">
  2578. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2579. <parameters exeFile="SfsServer.exe"/>
  2580. </event>
  2581.  
  2582. <event seq="409" time="2019-02-11 08:14:56.224519 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  2583. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2584. <sfs moduleName="FlowSfsRoot" code="11901" desc="Initializing module with the following settings.">
  2585. <parameters
  2586. settings="Root
  2587. HomePath=/
  2588. CreateHome=No
  2589. ShowRelative=Yes
  2590. DelayInit=Yes
  2591. Provider=FlowSfsWin
  2592. MountPath=/
  2593. MountMode=List,ReadExist,WriteExist,ReadWriteDeleteNew,CreateDir,CreateLink
  2594. RootPath=C:\Share
  2595. CreateRoot=No
  2596. MaxPathLength=3000
  2597. DelayInit=Yes
  2598. ShowEmptyDir=IfNoAccess
  2599. FileShareBeh=Default
  2600. FileShare=Read,Write
  2601. OwnerGroup=IfUnknown-Default
  2602. Acl=IfUnknownAce-DefaultAcl"/>
  2603. </sfs>
  2604. </event>
  2605.  
  2606. <event seq="410" time="2019-02-11 08:14:56.224568 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  2607. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2608. <sfs moduleName="FlowSfsRoot" code="11000" desc="Initializing module succeeded."/>
  2609. </event>
  2610.  
  2611. <event seq="411" time="2019-02-11 08:14:56.224583 -0700" app="BvSshServer 8.24" name="I_SFS_QUERY_HOME_DIRECTORY" desc="Virtual filesystem: query home directory.">
  2612. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2613. <sfs moduleName="FlowSfsRoot" code="40000" desc="Querying home directory succeeded.">
  2614. <parameters homePath="/"/>
  2615. </sfs>
  2616. </event>
  2617.  
  2618. <event seq="412" time="2019-02-11 08:14:56.224653 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2619. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2620. <parameters command="OPTS UTF8 ON"/>
  2621. </event>
  2622.  
  2623. <event seq="413" time="2019-02-11 08:14:56.224681 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2624. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2625. <parameters reply="202 The UTF8 option is already enabled"/>
  2626. </event>
  2627.  
  2628. <event seq="414" time="2019-02-11 08:14:56.238953 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2629. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2630. <parameters command="PBSZ 0"/>
  2631. </event>
  2632.  
  2633. <event seq="415" time="2019-02-11 08:14:56.238984 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2634. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2635. <parameters reply="200 PBSZ=0"/>
  2636. </event>
  2637.  
  2638. <event seq="416" time="2019-02-11 08:14:56.252961 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2639. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2640. <parameters command="PROT P"/>
  2641. </event>
  2642.  
  2643. <event seq="417" time="2019-02-11 08:14:56.25221 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2644. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2645. <parameters reply="200 Data protection level set to Private"/>
  2646. </event>
  2647.  
  2648. <event seq="418" time="2019-02-11 08:14:56.270930 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2649. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2650. <parameters command="PWD"/>
  2651. </event>
  2652.  
  2653. <event seq="419" time="2019-02-11 08:14:56.270960 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2654. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2655. <parameters reply="257 &quot;/&quot; is current directory"/>
  2656. </event>
  2657.  
  2658. <event seq="420" time="2019-02-11 08:14:57.035971 -0700" app="BvSshServer 8.24" name="I_SESSION_DISCONNECTED_NORMALLY" desc="Session disconnected normally.">
  2659. <session id="1013" service="FTP" remoteAddress="8.8.8.8:51310" loc="CA/NA"/>
  2660. <parameters disconnectReason="Socket" socketBytesReceived="369" socketBytesSent="191" payloadBytesReceived="0" payloadBytesSent="0"/>
  2661. <error type="Flow" component="FtpManager/socketReader" class="WinApi" code="10054" message="An existing connection was forcibly closed by the remote host." description="FlowSocketReader: Error receiving bytes"/>
  2662. </event>
  2663.  
  2664. <event seq="421" time="2019-02-11 08:14:59.693025 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2665. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2666. <parameters command="TYPE I"/>
  2667. </event>
  2668.  
  2669. <event seq="422" time="2019-02-11 08:14:59.693100 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2670. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2671. <parameters reply="200 Representation type set to Image"/>
  2672. </event>
  2673.  
  2674. <event seq="423" time="2019-02-11 08:14:59.694266 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_EOF_RECEIVED" desc="Received EOF on FTP control connection.">
  2675. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2676. <parameters eofType="SocketEof"/>
  2677. </event>
  2678.  
  2679. <event seq="424" time="2019-02-11 08:14:59.697213 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  2680. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2681. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  2682. <parameters path="C:\Share" type="Directory" how="ByCleanup"/>
  2683. </sfs>
  2684. </event>
  2685.  
  2686. <event seq="425" time="2019-02-11 08:14:59.699365 -0700" app="BvSshServer 8.24" name="I_SESSION_DISCONNECTED_NORMALLY" desc="Session disconnected normally.">
  2687. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2688. <parameters disconnectReason="EndOfSession" socketBytesReceived="1070" socketBytesSent="2122" payloadBytesReceived="102" payloadBytesSent="274"/>
  2689. <sessions ssh="1" sshAuth="1" ftp="1" ftpAuth="1"/>
  2690. <help message="The session has ended normally."/>
  2691. </event>
  2692.  
  2693. <event seq="426" time="2019-02-11 08:14:59.699411 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_NO_PROCESS_HANDLE" desc="No process handle supplied.">
  2694. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2695. <parameters processFrom="OnLogonCommand"/>
  2696. </event>
  2697.  
  2698. <event seq="427" time="2019-02-11 08:14:59.699426 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_NO_PROCESS_HANDLE" desc="No process handle supplied.">
  2699. <session id="1011" service="FTP" remoteAddress="8.8.8.8:51307" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2700. <parameters processFrom="OnLogoffCommand"/>
  2701. </event>
  2702.  
  2703. <event seq="428" time="2019-02-11 08:14:59.700014 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_PROCESS_COMPLETED" desc="Process completed; terminating job.">
  2704. <parameters processFrom="FtpSession" exitCode="0"/>
  2705. </event>
  2706.  
  2707. <event seq="429" time="2019-02-11 08:14:59.710995 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2708. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2709. <parameters command="PASV"/>
  2710. </event>
  2711.  
  2712. <event seq="430" time="2019-02-11 08:14:59.711141 -0700" app="BvSshServer 8.24" name="T_FTP_DATA_ACCEPT_STARTED" desc="Passive FTP data connection attempt started.">
  2713. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2714. <parameters listenAddress="0.0.0.0:49225" replyAddress="0.0.0.0:49225"/>
  2715. </event>
  2716.  
  2717. <event seq="431" time="2019-02-11 08:14:59.711207 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2718. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2719. <parameters reply="227 Entering Passive Mode (0,0,0,0,192,73)"/>
  2720. </event>
  2721.  
  2722. <event seq="432" time="2019-02-11 08:14:59.728013 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2723. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2724. <parameters command="LIST"/>
  2725. </event>
  2726.  
  2727. <event seq="433" time="2019-02-11 08:14:59.729042 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  2728. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2729. <sfs moduleName="FlowSfsRoot" code="26904" desc="Paths processed.">
  2730. <parameters pathRaw="/" path="/"/>
  2731. <handler moduleName="FlowSfsWin" mountPath="/"/>
  2732. </sfs>
  2733. </event>
  2734.  
  2735. <event seq="434" time="2019-02-11 08:14:59.729080 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  2736. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2737. <sfs moduleName="FlowSfsWin" mountPath="/" code="11000" desc="Initializing module succeeded."/>
  2738. </event>
  2739.  
  2740. <event seq="435" time="2019-02-11 08:14:59.729167 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  2741. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2742. <sfs moduleName="FlowSfsWin" mountPath="/" code="26000" desc="Opening directory succeeded.">
  2743. <parameters path="C:\Share"/>
  2744. </sfs>
  2745. </event>
  2746.  
  2747. <event seq="436" time="2019-02-11 08:14:59.729251 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2748. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2749. <parameters reply="150 Opening data connection"/>
  2750. </event>
  2751.  
  2752. <event seq="437" time="2019-02-11 08:15:00.407827 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_PROCESS_COMPLETED" desc="Process completed; terminating job.">
  2753. <channel type="session" id="1"/>
  2754. <parameters processFrom="SessionChannel" exitCode="0"/>
  2755. </event>
  2756.  
  2757. <event seq="438" time="2019-02-11 08:15:00.407814 -0700" app="BvSshServer 8.24" name="I_CHANNEL_SESSION_CLOSED" desc="Session channel closed.">
  2758. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2759. <channel type="session" id="1"/>
  2760. <parameters bytesReceived="1613" bytesSent="84161"/>
  2761. </event>
  2762.  
  2763. <event seq="439" time="2019-02-11 08:15:00.429876 -0700" app="BvSshServer 8.24" name="I_SESSION_DISCONNECTED_NORMALLY" desc="Session disconnected normally.">
  2764. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2765. <parameters disconnectReason="EofReceived" socketBytesReceived="6598" socketBytesSent="93857" payloadBytesReceived="3869" payloadBytesSent="87144" channelBytesReceived="1613" channelBytesSent="84161"/>
  2766. <sessions ssh="0" sshAuth="0" ftp="1" ftpAuth="1"/>
  2767. <help message="The client has disconnected the session by sending EOF."/>
  2768. </event>
  2769.  
  2770. <event seq="440" time="2019-02-11 08:15:00.429921 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_NO_PROCESS_HANDLE" desc="No process handle supplied.">
  2771. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2772. <parameters processFrom="OnLogonCommand"/>
  2773. </event>
  2774.  
  2775. <event seq="441" time="2019-02-11 08:15:00.429938 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_NO_PROCESS_HANDLE" desc="No process handle supplied.">
  2776. <session id="1002" service="SSH" remoteAddress="8.8.8.8:51283" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2777. <parameters processFrom="OnLogoffCommand"/>
  2778. </event>
  2779.  
  2780. <event seq="442" time="2019-02-11 08:15:19.647997 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_EOF_RECEIVED" desc="Received EOF on FTP control connection.">
  2781. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2782. <parameters eofType="SocketEof"/>
  2783. </event>
  2784.  
  2785. <event seq="443" time="2019-02-11 08:15:19.651022 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  2786. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2787. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  2788. <parameters path="C:\Share" type="Directory" how="ByCleanup"/>
  2789. </sfs>
  2790. </event>
  2791.  
  2792. <event seq="444" time="2019-02-11 08:15:19.753742 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_PROCESS_COMPLETED" desc="Process completed; terminating job.">
  2793. <parameters processFrom="FtpSession" exitCode="0"/>
  2794. </event>
  2795.  
  2796. <event seq="445" time="2019-02-11 08:15:19.753287 -0700" app="BvSshServer 8.24" name="I_SESSION_DISCONNECTED_NORMALLY" desc="Session disconnected normally.">
  2797. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2798. <parameters disconnectReason="EndOfSession" socketBytesReceived="1070" socketBytesSent="2122" payloadBytesReceived="102" payloadBytesSent="274"/>
  2799. <sessions ssh="0" sshAuth="0" ftp="0" ftpAuth="0"/>
  2800. <help message="The session has ended normally."/>
  2801. </event>
  2802.  
  2803. <event seq="446" time="2019-02-11 08:15:19.753342 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_NO_PROCESS_HANDLE" desc="No process handle supplied.">
  2804. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2805. <parameters processFrom="OnLogonCommand"/>
  2806. </event>
  2807.  
  2808. <event seq="447" time="2019-02-11 08:15:19.753366 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_NO_PROCESS_HANDLE" desc="No process handle supplied.">
  2809. <session id="1014" service="FTP" remoteAddress="8.8.8.8:51311" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2810. <parameters processFrom="OnLogoffCommand"/>
  2811. </event>
  2812.  
  2813. <event seq="448" time="2019-02-11 08:15:19.774837 -0700" app="BvSshServer 8.24" name="I_CONNECT_ACCEPTED" desc="Connection accepted.">
  2814. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA"/>
  2815. <location continent="North America" country="Canada"/>
  2816. <parameters addressRule="AnyIP" listenAddress="192.168.0.2:21"/>
  2817. <sessions ssh="0" sshAuth="0" ftp="1" ftpAuth="0"/>
  2818. </event>
  2819.  
  2820. <event seq="449" time="2019-02-11 08:15:19.775180 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2821. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA"/>
  2822. <parameters reply="220 Bitvise SSH Server 8.24"/>
  2823. </event>
  2824.  
  2825. <event seq="450" time="2019-02-11 08:15:19.790878 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2826. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA"/>
  2827. <parameters command="AUTH TLS"/>
  2828. </event>
  2829.  
  2830. <event seq="451" time="2019-02-11 08:15:19.790910 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2831. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA"/>
  2832. <parameters reply="234 Security mechanism set to TLS"/>
  2833. </event>
  2834.  
  2835. <event seq="452" time="2019-02-11 08:15:19.970320 -0700" app="BvSshServer 8.24" name="I_FTP_CONTROL_TLS_NEGOTIATED" desc="TLS algorithms for FTP control connection negotiated.">
  2836. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA"/>
  2837. <parameters negNr="1" protocol="TLS 1.2" cipherSuite="TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256"/>
  2838. </event>
  2839.  
  2840. <event seq="453" time="2019-02-11 08:15:19.986993 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2841. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA"/>
  2842. <parameters command="USER testuser"/>
  2843. </event>
  2844.  
  2845. <event seq="454" time="2019-02-11 08:15:19.987062 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2846. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA"/>
  2847. <parameters reply="331 Need password"/>
  2848. </event>
  2849.  
  2850. <event seq="455" time="2019-02-11 08:15:20.000977 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2851. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA"/>
  2852. <parameters command="PASS ***"/>
  2853. </event>
  2854.  
  2855. <event seq="456" time="2019-02-11 08:15:20.001050 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_ATTEMPT_STARTED" desc="User authentication attempt started.">
  2856. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA"/>
  2857. <authentication attemptNr="1" userName="testuser" method="password"/>
  2858. </event>
  2859.  
  2860. <event seq="457" time="2019-02-11 08:15:20.028680 -0700" app="BvSshServer 8.24" name="T_LOGON_PROCEDURE_TIMING" desc="Logon procedure timing.">
  2861. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA"/>
  2862. <parameters procedure="LogonUser()" timerMs="1"/>
  2863. </event>
  2864.  
  2865. <event seq="458" time="2019-02-11 08:15:20.028721 -0700" app="BvSshServer 8.24" name="T_LOGON_TOKEN_ELEVATION_CHANGE_FAILED" desc="Could not change or obtain user token elevation state.">
  2866. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA"/>
  2867. <parameters desiredElevation="Yes" failureReason="LinkedTokenNotAvailable"/>
  2868. <help message="Elevation state cannot be changed for sessions with the 'network' logon type."/>
  2869. </event>
  2870.  
  2871. <event seq="459" time="2019-02-11 08:15:20.041073 -0700" app="BvSshServer 8.24" name="T_LOGON_PROCEDURE_TIMING" desc="Logon procedure timing.">
  2872. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA"/>
  2873. <parameters procedure="NetUserGetInfo()" timerMs="12"/>
  2874. </event>
  2875.  
  2876. <event seq="460" time="2019-02-11 08:15:20.041581 -0700" app="BvSshServer 8.24" name="I_LOGON_AUTH_SUCCEEDED" desc="User authentication succeeded.">
  2877. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2878. <authentication attemptNr="1" serialize="completion" userName="testuser" method="password"/>
  2879. <parameters accountSettings="testuser" groupSettings="Virtual Users" tokenType="LogonUser" tokenLogonType="Network" tokenElevation="Restricted"/>
  2880. </event>
  2881.  
  2882. <event seq="461" time="2019-02-11 08:15:20.041678 -0700" app="BvSshServer 8.24" name="T_LOGON_HOME_DIRECTORY_RETRIEVE_ERROR" desc="Error retrieving home directory.">
  2883. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2884. <error type="WinApi" operation="GetUserProfileDirectory()" code="2" message="The system cannot find the file specified."/>
  2885. </event>
  2886.  
  2887. <event seq="462" time="2019-02-11 08:15:20.042579 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_ATTEMPT_ENDED" desc="User authentication attempt ended.">
  2888. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2889. <authentication attemptNr="1" serialize="completion" userName="testuser" method="password"/>
  2890. </event>
  2891.  
  2892. <event seq="463" time="2019-02-11 08:15:20.042611 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2893. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2894. <parameters reply="230 User logged in"/>
  2895. </event>
  2896.  
  2897. <event seq="464" time="2019-02-11 08:15:20.047899 -0700" app="BvSshServer 8.24" name="T_SUBSYS_EXECUTED" desc="SSH server subsystem executed.">
  2898. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2899. <parameters exeFile="SfsServer.exe"/>
  2900. </event>
  2901.  
  2902. <event seq="465" time="2019-02-11 08:15:20.048609 -0700" app="BvSshServer 8.24" name="T_STATS_FILE_READ_COMPLETED" desc="Reading stats file completed.">
  2903. <parameters statsType="VirtGroup" virtualGroup="Virtual Users" file="BssStats-nbvg-Virtual Users-00.xml"/>
  2904. </event>
  2905.  
  2906. <event seq="466" time="2019-02-11 08:15:20.048889 -0700" app="BvSshServer 8.24" name="T_STATS_FILE_READ_COMPLETED" desc="Reading stats file completed.">
  2907. <parameters statsType="VirtAccount" virtualAccount="testuser" file="BssStats-nbva-testuser-00.xml"/>
  2908. </event>
  2909.  
  2910. <event seq="467" time="2019-02-11 08:15:20.064949 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  2911. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2912. <sfs moduleName="FlowSfsRoot" code="11901" desc="Initializing module with the following settings.">
  2913. <parameters
  2914. settings="Root
  2915. HomePath=/
  2916. CreateHome=No
  2917. ShowRelative=Yes
  2918. DelayInit=Yes
  2919. Provider=FlowSfsWin
  2920. MountPath=/
  2921. MountMode=List,ReadExist,WriteExist,ReadWriteDeleteNew,CreateDir,CreateLink
  2922. RootPath=C:\Share
  2923. CreateRoot=No
  2924. MaxPathLength=3000
  2925. DelayInit=Yes
  2926. ShowEmptyDir=IfNoAccess
  2927. FileShareBeh=Default
  2928. FileShare=Read,Write
  2929. OwnerGroup=IfUnknown-Default
  2930. Acl=IfUnknownAce-DefaultAcl"/>
  2931. </sfs>
  2932. </event>
  2933.  
  2934. <event seq="468" time="2019-02-11 08:15:20.064996 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  2935. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2936. <sfs moduleName="FlowSfsRoot" code="11000" desc="Initializing module succeeded."/>
  2937. </event>
  2938.  
  2939. <event seq="469" time="2019-02-11 08:15:20.065011 -0700" app="BvSshServer 8.24" name="I_SFS_QUERY_HOME_DIRECTORY" desc="Virtual filesystem: query home directory.">
  2940. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2941. <sfs moduleName="FlowSfsRoot" code="40000" desc="Querying home directory succeeded.">
  2942. <parameters homePath="/"/>
  2943. </sfs>
  2944. </event>
  2945.  
  2946. <event seq="470" time="2019-02-11 08:15:20.065151 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2947. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2948. <parameters command="OPTS UTF8 ON"/>
  2949. </event>
  2950.  
  2951. <event seq="471" time="2019-02-11 08:15:20.065182 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2952. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2953. <parameters reply="202 The UTF8 option is already enabled"/>
  2954. </event>
  2955.  
  2956. <event seq="472" time="2019-02-11 08:15:20.087094 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2957. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2958. <parameters command="PBSZ 0"/>
  2959. </event>
  2960.  
  2961. <event seq="473" time="2019-02-11 08:15:20.087142 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2962. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2963. <parameters reply="200 PBSZ=0"/>
  2964. </event>
  2965.  
  2966. <event seq="474" time="2019-02-11 08:15:20.103976 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2967. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2968. <parameters command="PROT P"/>
  2969. </event>
  2970.  
  2971. <event seq="475" time="2019-02-11 08:15:20.104023 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2972. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2973. <parameters reply="200 Data protection level set to Private"/>
  2974. </event>
  2975.  
  2976. <event seq="476" time="2019-02-11 08:15:20.122976 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2977. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2978. <parameters command="PWD"/>
  2979. </event>
  2980.  
  2981. <event seq="477" time="2019-02-11 08:15:20.123027 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2982. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2983. <parameters reply="257 &quot;/&quot; is current directory"/>
  2984. </event>
  2985.  
  2986. <event seq="478" time="2019-02-11 08:15:20.143009 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2987. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2988. <parameters command="TYPE I"/>
  2989. </event>
  2990.  
  2991. <event seq="479" time="2019-02-11 08:15:20.143061 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  2992. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2993. <parameters reply="200 Representation type set to Image"/>
  2994. </event>
  2995.  
  2996. <event seq="480" time="2019-02-11 08:15:20.163033 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  2997. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  2998. <parameters command="PASV"/>
  2999. </event>
  3000.  
  3001. <event seq="481" time="2019-02-11 08:15:20.163199 -0700" app="BvSshServer 8.24" name="T_FTP_DATA_ACCEPT_STARTED" desc="Passive FTP data connection attempt started.">
  3002. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3003. <parameters listenAddress="0.0.0.0:49225" replyAddress="0.0.0.0:49225"/>
  3004. </event>
  3005.  
  3006. <event seq="482" time="2019-02-11 08:15:20.163269 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  3007. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3008. <parameters reply="227 Entering Passive Mode (0,0,0,0,192,73)"/>
  3009. </event>
  3010.  
  3011. <event seq="483" time="2019-02-11 08:15:20.180940 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  3012. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3013. <parameters command="LIST"/>
  3014. </event>
  3015.  
  3016. <event seq="484" time="2019-02-11 08:15:20.182053 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  3017. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3018. <sfs moduleName="FlowSfsRoot" code="26904" desc="Paths processed.">
  3019. <parameters pathRaw="/" path="/"/>
  3020. <handler moduleName="FlowSfsWin" mountPath="/"/>
  3021. </sfs>
  3022. </event>
  3023.  
  3024. <event seq="485" time="2019-02-11 08:15:20.182099 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  3025. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3026. <sfs moduleName="FlowSfsWin" mountPath="/" code="11000" desc="Initializing module succeeded."/>
  3027. </event>
  3028.  
  3029. <event seq="486" time="2019-02-11 08:15:20.182175 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  3030. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3031. <sfs moduleName="FlowSfsWin" mountPath="/" code="26000" desc="Opening directory succeeded.">
  3032. <parameters path="C:\Share"/>
  3033. </sfs>
  3034. </event>
  3035.  
  3036. <event seq="487" time="2019-02-11 08:15:20.182258 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  3037. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3038. <parameters reply="150 Opening data connection"/>
  3039. </event>
  3040.  
  3041. <event seq="488" time="2019-02-11 08:15:40.022999 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_EOF_RECEIVED" desc="Received EOF on FTP control connection.">
  3042. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3043. <parameters eofType="SocketEof"/>
  3044. </event>
  3045.  
  3046. <event seq="489" time="2019-02-11 08:15:40.026154 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  3047. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3048. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  3049. <parameters path="C:\Share" type="Directory" how="ByCleanup"/>
  3050. </sfs>
  3051. </event>
  3052.  
  3053. <event seq="490" time="2019-02-11 08:15:40.028313 -0700" app="BvSshServer 8.24" name="I_SESSION_DISCONNECTED_NORMALLY" desc="Session disconnected normally.">
  3054. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3055. <parameters disconnectReason="EndOfSession" socketBytesReceived="1070" socketBytesSent="2122" payloadBytesReceived="102" payloadBytesSent="274"/>
  3056. <sessions ssh="0" sshAuth="0" ftp="0" ftpAuth="0"/>
  3057. <help message="The session has ended normally."/>
  3058. </event>
  3059.  
  3060. <event seq="491" time="2019-02-11 08:15:40.028359 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_NO_PROCESS_HANDLE" desc="No process handle supplied.">
  3061. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3062. <parameters processFrom="OnLogonCommand"/>
  3063. </event>
  3064.  
  3065. <event seq="492" time="2019-02-11 08:15:40.028374 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_NO_PROCESS_HANDLE" desc="No process handle supplied.">
  3066. <session id="1015" service="FTP" remoteAddress="8.8.8.8:51313" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3067. <parameters processFrom="OnLogoffCommand"/>
  3068. </event>
  3069.  
  3070. <event seq="493" time="2019-02-11 08:15:40.029617 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_PROCESS_COMPLETED" desc="Process completed; terminating job.">
  3071. <parameters processFrom="FtpSession" exitCode="0"/>
  3072. </event>
  3073.  
  3074. <event seq="494" time="2019-02-11 08:16:53.426779 -0700" app="BvSshServer 8.24" name="T_SERVICE_CONFIG_RELOAD_STARTED" desc="Started reloading configuration.">
  3075. <parameters configPart="ServerSettings"/>
  3076. </event>
  3077.  
  3078. <event seq="495" time="2019-02-11 08:16:53.934120 -0700" app="BvSshServer 8.24" name="I_SERVICE_CONFIG_DESCRIPTION" desc="Configuration description.">
  3079. <parameters configPart="ServerSettings"/>
  3080. <change time="2019-02-11 08:16:53.352615 -0700" action="Settings edited via local Advanced Settings interface by 'domain.local\MyUsername'." process="BssCtrl.exe"/>
  3081. <settings>
  3082. <powerShellDiff><![CDATA[
  3083. @ -7,6 +7,9
  3084. $cfg.settings.server.bindings.ipv4.new.SetDefaults()
  3085. $cfg.settings.server.bindings.ipv4.new.serviceType = 1 # $cfg.enums.ServiceType.ftp
  3086. $cfg.settings.server.bindings.ipv4.new.port = 21
  3087. +$cfg.settings.server.bindings.ipv4.new.pasvPort = 61001
  3088. +$cfg.settings.server.bindings.ipv4.new.overridePasvAddr = $true
  3089. +$cfg.settings.server.bindings.ipv4.new.pasvAddress = "74.3.185.50"
  3090. $cfg.settings.server.bindings.ipv4.NewCommit()
  3091. $cfg.settings.server.bindings.ipv4.new.SetDefaults()
  3092. $cfg.settings.server.bindings.ipv4.new.port = 22
  3093. @ -23,6 +26,8
  3094. $cfg.settings.access.SetDefaults()
  3095. $cfg.settings.access.passwordMethod = 3 # $cfg.enums.GlobalAuthMethod.permitVirtAccounts
  3096. $cfg.settings.access.kbdiPasswordMethod = 3 # $cfg.enums.GlobalAuthMethod.permitVirtAccounts
  3097. +$cfg.settings.access.allowWinAccountPasswordChange = $false
  3098. +$cfg.settings.access.allowVirtAccountPasswordChange = $false
  3099. $cfg.settings.access.virtAccounts.Clear()
  3100. $cfg.settings.access.virtAccounts.new.SetDefaults()
  3101. $cfg.settings.access.virtAccounts.new.virtAccount = "testuser"
  3102. ]]></powerShellDiff>
  3103. </settings>
  3104. </event>
  3105.  
  3106. <event seq="496" time="2019-02-11 08:16:53.984341 -0700" app="BvSshServer 8.24" name="I_FIREWALL_EXCEPTION_REMOVED" desc="Windows Firewall exception removed.">
  3107. <parameters port="49225" type="TCP/IPv4"/>
  3108. </event>
  3109.  
  3110. <event seq="497" time="2019-02-11 08:16:53.984382 -0700" app="BvSshServer 8.24" name="I_SERVICE_SOCKET_UNBOUND" desc="Listening socket unbound.">
  3111. <parameters listenAddress="0.0.0.0:49225" unbindReason="NotPresentInReloadedConfig"/>
  3112. </event>
  3113.  
  3114. <event seq="498" time="2019-02-11 08:16:53.984484 -0700" app="BvSshServer 8.24" name="I_SERVICE_SOCKET_BOUND" desc="Listening socket bound.">
  3115. <parameters listenAddress="0.0.0.0:61001" service="FTP" serviceAddress="0.0.0.0:21"/>
  3116. </event>
  3117.  
  3118. <event seq="499" time="2019-02-11 08:16:53.996548 -0700" app="BvSshServer 8.24" name="I_FIREWALL_EXCEPTION_ADDED" desc="Windows Firewall exception added.">
  3119. <parameters port="61001" scope="Global" type="TCP/IPv4"/>
  3120. </event>
  3121.  
  3122. <event seq="500" time="2019-02-11 08:16:53.996722 -0700" app="BvSshServer 8.24" name="I_SERVICE_CONFIG_RELOAD_SUCCESS" desc="Configuration reloaded successfully.">
  3123. <parameters configPart="ServerSettings"/>
  3124. <help message="Reloaded settings have been applied."/>
  3125. </event>
  3126.  
  3127. <event seq="501" time="2019-02-11 08:17:07.923392 -0700" app="BvSshServer 8.24" name="I_CONNECT_ACCEPTED" desc="Connection accepted.">
  3128. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA"/>
  3129. <location continent="North America" country="Canada"/>
  3130. <parameters addressRule="AnyIP" listenAddress="192.168.0.2:21"/>
  3131. <sessions ssh="0" sshAuth="0" ftp="1" ftpAuth="0"/>
  3132. </event>
  3133.  
  3134. <event seq="502" time="2019-02-11 08:17:07.923780 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  3135. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA"/>
  3136. <parameters reply="220 Bitvise SSH Server 8.24"/>
  3137. </event>
  3138.  
  3139. <event seq="503" time="2019-02-11 08:17:07.937899 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  3140. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA"/>
  3141. <parameters command="AUTH TLS"/>
  3142. </event>
  3143.  
  3144. <event seq="504" time="2019-02-11 08:17:07.937940 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  3145. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA"/>
  3146. <parameters reply="234 Security mechanism set to TLS"/>
  3147. </event>
  3148.  
  3149. <event seq="505" time="2019-02-11 08:17:08.015490 -0700" app="BvSshServer 8.24" name="I_FTP_CONTROL_TLS_NEGOTIATED" desc="TLS algorithms for FTP control connection negotiated.">
  3150. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA"/>
  3151. <parameters negNr="1" protocol="TLS 1.2" cipherSuite="TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256"/>
  3152. </event>
  3153.  
  3154. <event seq="506" time="2019-02-11 08:17:08.031950 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  3155. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA"/>
  3156. <parameters command="USER testuser"/>
  3157. </event>
  3158.  
  3159. <event seq="507" time="2019-02-11 08:17:08.032010 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  3160. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA"/>
  3161. <parameters reply="331 Need password"/>
  3162. </event>
  3163.  
  3164. <event seq="508" time="2019-02-11 08:17:08.045975 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  3165. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA"/>
  3166. <parameters command="PASS ***"/>
  3167. </event>
  3168.  
  3169. <event seq="509" time="2019-02-11 08:17:08.046022 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_ATTEMPT_STARTED" desc="User authentication attempt started.">
  3170. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA"/>
  3171. <authentication attemptNr="1" userName="testuser" method="password"/>
  3172. </event>
  3173.  
  3174. <event seq="510" time="2019-02-11 08:17:08.075360 -0700" app="BvSshServer 8.24" name="T_LOGON_PROCEDURE_TIMING" desc="Logon procedure timing.">
  3175. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA"/>
  3176. <parameters procedure="LogonUser()" timerMs="1"/>
  3177. </event>
  3178.  
  3179. <event seq="511" time="2019-02-11 08:17:08.075400 -0700" app="BvSshServer 8.24" name="T_LOGON_TOKEN_ELEVATION_CHANGE_FAILED" desc="Could not change or obtain user token elevation state.">
  3180. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA"/>
  3181. <parameters desiredElevation="Yes" failureReason="LinkedTokenNotAvailable"/>
  3182. <help message="Elevation state cannot be changed for sessions with the 'network' logon type."/>
  3183. </event>
  3184.  
  3185. <event seq="512" time="2019-02-11 08:17:08.080677 -0700" app="BvSshServer 8.24" name="T_LOGON_PROCEDURE_TIMING" desc="Logon procedure timing.">
  3186. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA"/>
  3187. <parameters procedure="NetUserGetInfo()" timerMs="5"/>
  3188. </event>
  3189.  
  3190. <event seq="513" time="2019-02-11 08:17:08.081257 -0700" app="BvSshServer 8.24" name="I_LOGON_AUTH_SUCCEEDED" desc="User authentication succeeded.">
  3191. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3192. <authentication attemptNr="1" serialize="completion" userName="testuser" method="password"/>
  3193. <parameters accountSettings="testuser" groupSettings="Virtual Users" tokenType="LogonUser" tokenLogonType="Network" tokenElevation="Restricted"/>
  3194. </event>
  3195.  
  3196. <event seq="514" time="2019-02-11 08:17:08.081355 -0700" app="BvSshServer 8.24" name="T_LOGON_HOME_DIRECTORY_RETRIEVE_ERROR" desc="Error retrieving home directory.">
  3197. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3198. <error type="WinApi" operation="GetUserProfileDirectory()" code="2" message="The system cannot find the file specified."/>
  3199. </event>
  3200.  
  3201. <event seq="515" time="2019-02-11 08:17:08.082151 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_ATTEMPT_ENDED" desc="User authentication attempt ended.">
  3202. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3203. <authentication attemptNr="1" serialize="completion" userName="testuser" method="password"/>
  3204. </event>
  3205.  
  3206. <event seq="516" time="2019-02-11 08:17:08.082185 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  3207. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3208. <parameters reply="230 User logged in"/>
  3209. </event>
  3210.  
  3211. <event seq="517" time="2019-02-11 08:17:08.087336 -0700" app="BvSshServer 8.24" name="T_SUBSYS_EXECUTED" desc="SSH server subsystem executed.">
  3212. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3213. <parameters exeFile="SfsServer.exe"/>
  3214. </event>
  3215.  
  3216. <event seq="518" time="2019-02-11 08:17:08.088029 -0700" app="BvSshServer 8.24" name="T_STATS_FILE_READ_COMPLETED" desc="Reading stats file completed.">
  3217. <parameters statsType="VirtGroup" virtualGroup="Virtual Users" file="BssStats-nbvg-Virtual Users-00.xml"/>
  3218. </event>
  3219.  
  3220. <event seq="519" time="2019-02-11 08:17:08.088357 -0700" app="BvSshServer 8.24" name="T_STATS_FILE_READ_COMPLETED" desc="Reading stats file completed.">
  3221. <parameters statsType="VirtAccount" virtualAccount="testuser" file="BssStats-nbva-testuser-00.xml"/>
  3222. </event>
  3223.  
  3224. <event seq="520" time="2019-02-11 08:17:08.104667 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  3225. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3226. <sfs moduleName="FlowSfsRoot" code="11901" desc="Initializing module with the following settings.">
  3227. <parameters
  3228. settings="Root
  3229. HomePath=/
  3230. CreateHome=No
  3231. ShowRelative=Yes
  3232. DelayInit=Yes
  3233. Provider=FlowSfsWin
  3234. MountPath=/
  3235. MountMode=List,ReadExist,WriteExist,ReadWriteDeleteNew,CreateDir,CreateLink
  3236. RootPath=C:\Share
  3237. CreateRoot=No
  3238. MaxPathLength=3000
  3239. DelayInit=Yes
  3240. ShowEmptyDir=IfNoAccess
  3241. FileShareBeh=Default
  3242. FileShare=Read,Write
  3243. OwnerGroup=IfUnknown-Default
  3244. Acl=IfUnknownAce-DefaultAcl"/>
  3245. </sfs>
  3246. </event>
  3247.  
  3248. <event seq="521" time="2019-02-11 08:17:08.104714 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  3249. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3250. <sfs moduleName="FlowSfsRoot" code="11000" desc="Initializing module succeeded."/>
  3251. </event>
  3252.  
  3253. <event seq="522" time="2019-02-11 08:17:08.104730 -0700" app="BvSshServer 8.24" name="I_SFS_QUERY_HOME_DIRECTORY" desc="Virtual filesystem: query home directory.">
  3254. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3255. <sfs moduleName="FlowSfsRoot" code="40000" desc="Querying home directory succeeded.">
  3256. <parameters homePath="/"/>
  3257. </sfs>
  3258. </event>
  3259.  
  3260. <event seq="523" time="2019-02-11 08:17:08.104801 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  3261. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3262. <parameters command="OPTS UTF8 ON"/>
  3263. </event>
  3264.  
  3265. <event seq="524" time="2019-02-11 08:17:08.104831 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  3266. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3267. <parameters reply="202 The UTF8 option is already enabled"/>
  3268. </event>
  3269.  
  3270. <event seq="525" time="2019-02-11 08:17:08.119004 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  3271. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3272. <parameters command="PBSZ 0"/>
  3273. </event>
  3274.  
  3275. <event seq="526" time="2019-02-11 08:17:08.119038 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  3276. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3277. <parameters reply="200 PBSZ=0"/>
  3278. </event>
  3279.  
  3280. <event seq="527" time="2019-02-11 08:17:08.132992 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  3281. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3282. <parameters command="PROT P"/>
  3283. </event>
  3284.  
  3285. <event seq="528" time="2019-02-11 08:17:08.133026 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  3286. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3287. <parameters reply="200 Data protection level set to Private"/>
  3288. </event>
  3289.  
  3290. <event seq="529" time="2019-02-11 08:17:08.149927 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  3291. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3292. <parameters command="PWD"/>
  3293. </event>
  3294.  
  3295. <event seq="530" time="2019-02-11 08:17:08.149966 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  3296. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3297. <parameters reply="257 &quot;/&quot; is current directory"/>
  3298. </event>
  3299.  
  3300. <event seq="531" time="2019-02-11 08:17:08.163986 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  3301. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3302. <parameters command="TYPE I"/>
  3303. </event>
  3304.  
  3305. <event seq="532" time="2019-02-11 08:17:08.164022 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  3306. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3307. <parameters reply="200 Representation type set to Image"/>
  3308. </event>
  3309.  
  3310. <event seq="533" time="2019-02-11 08:17:08.177943 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  3311. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3312. <parameters command="PASV"/>
  3313. </event>
  3314.  
  3315. <event seq="534" time="2019-02-11 08:17:08.178088 -0700" app="BvSshServer 8.24" name="T_FTP_DATA_ACCEPT_STARTED" desc="Passive FTP data connection attempt started.">
  3316. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3317. <parameters listenAddress="0.0.0.0:61001" replyAddress="74.3.185.50:61001"/>
  3318. </event>
  3319.  
  3320. <event seq="535" time="2019-02-11 08:17:08.178155 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  3321. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3322. <parameters reply="227 Entering Passive Mode (74,3,185,50,238,73)"/>
  3323. </event>
  3324.  
  3325. <event seq="536" time="2019-02-11 08:17:08.19221 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  3326. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3327. <parameters command="LIST"/>
  3328. </event>
  3329.  
  3330. <event seq="537" time="2019-02-11 08:17:08.194085 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  3331. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3332. <sfs moduleName="FlowSfsRoot" code="26904" desc="Paths processed.">
  3333. <parameters pathRaw="/" path="/"/>
  3334. <handler moduleName="FlowSfsWin" mountPath="/"/>
  3335. </sfs>
  3336. </event>
  3337.  
  3338. <event seq="538" time="2019-02-11 08:17:08.194137 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  3339. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3340. <sfs moduleName="FlowSfsWin" mountPath="/" code="11000" desc="Initializing module succeeded."/>
  3341. </event>
  3342.  
  3343. <event seq="539" time="2019-02-11 08:17:08.194217 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  3344. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3345. <sfs moduleName="FlowSfsWin" mountPath="/" code="26000" desc="Opening directory succeeded.">
  3346. <parameters path="C:\Share"/>
  3347. </sfs>
  3348. </event>
  3349.  
  3350. <event seq="540" time="2019-02-11 08:17:08.194304 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  3351. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3352. <parameters reply="150 Opening data connection"/>
  3353. </event>
  3354.  
  3355. <event seq="541" time="2019-02-11 08:17:08.208468 -0700" app="BvSshServer 8.24" name="I_FTP_PASV_DISPATCHER_DATA_ACCEPTED" desc="FTP passive data connection accepted.">
  3356. <parameters remoteAddress="8.8.8.8:51319" loc="CA/NA" listenAddress="0.0.0.0:61001" addressRule="AnyIP"/>
  3357. </event>
  3358.  
  3359. <event seq="542" time="2019-02-11 08:17:08.209445 -0700" app="BvSshServer 8.24" name="T_FTP_PASV_DISPATCHER_DATA_DISPATCHED" desc="FTP passive data connection dispatched to the FTP session.">
  3360. <parameters remoteAddress="8.8.8.8:51319" loc="CA/NA" listenAddress="0.0.0.0:61001" sessionId="1016"/>
  3361. </event>
  3362.  
  3363. <event seq="543" time="2019-02-11 08:17:08.209535 -0700" app="BvSshServer 8.24" name="I_FTP_DATA_ACCEPTED" desc="Passive FTP data connection accepted.">
  3364. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3365. <parameters remoteAddress="8.8.8.8:51319" loc="CA/NA" listenAddress="0.0.0.0:61001" operation="List"/>
  3366. </event>
  3367.  
  3368. <event seq="544" time="2019-02-11 08:17:08.228074 -0700" app="BvSshServer 8.24" name="I_FTP_DATA_TLS_NEGOTIATED" desc="TLS algorithms for FTP data connection negotiated.">
  3369. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3370. <parameters remoteAddress="8.8.8.8:51319" loc="CA/NA" operation="List" negNr="1" protocol="TLS 1.2" cipherSuite="TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256"/>
  3371. </event>
  3372.  
  3373. <event seq="545" time="2019-02-11 08:17:08.230412 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  3374. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3375. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  3376. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  3377. </sfs>
  3378. </event>
  3379.  
  3380. <event seq="546" time="2019-02-11 08:17:08.230451 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  3381. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3382. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  3383. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  3384. </sfs>
  3385. </event>
  3386.  
  3387. <event seq="547" time="2019-02-11 08:17:08.233774 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  3388. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3389. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  3390. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  3391. </sfs>
  3392. </event>
  3393.  
  3394. <event seq="548" time="2019-02-11 08:17:08.233807 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  3395. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3396. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  3397. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  3398. </sfs>
  3399. </event>
  3400.  
  3401. <event seq="549" time="2019-02-11 08:17:08.236563 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  3402. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3403. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  3404. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  3405. </sfs>
  3406. </event>
  3407.  
  3408. <event seq="550" time="2019-02-11 08:17:08.237776 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  3409. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3410. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  3411. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  3412. </sfs>
  3413. </event>
  3414.  
  3415. <event seq="551" time="2019-02-11 08:17:08.237809 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  3416. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3417. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  3418. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  3419. </sfs>
  3420. </event>
  3421.  
  3422. <event seq="552" time="2019-02-11 08:17:08.237884 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  3423. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3424. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  3425. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  3426. </sfs>
  3427. </event>
  3428.  
  3429. <event seq="553" time="2019-02-11 08:17:08.240120 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  3430. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3431. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  3432. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  3433. </sfs>
  3434. </event>
  3435.  
  3436. <event seq="554" time="2019-02-11 08:17:08.242335 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  3437. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3438. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  3439. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  3440. </sfs>
  3441. </event>
  3442.  
  3443. <event seq="555" time="2019-02-11 08:17:08.242370 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  3444. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3445. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  3446. <parameters path="C:\Share" entriesCount="11" reachedEof="true"/>
  3447. </sfs>
  3448. </event>
  3449.  
  3450. <event seq="556" time="2019-02-11 08:17:08.243530 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  3451. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3452. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  3453. <parameters path="C:\Share" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  3454. </sfs>
  3455. </event>
  3456.  
  3457. <event seq="557" time="2019-02-11 08:17:08.243561 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  3458. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3459. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  3460. <parameters path="C:\Share" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  3461. </sfs>
  3462. </event>
  3463.  
  3464. <event seq="558" time="2019-02-11 08:17:08.244550 -0700" app="BvSshServer 8.24" name="I_SFS_LIST_DIRECTORY" desc="Virtual filesystem: list directory.">
  3465. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3466. <sfs moduleName="FlowSfsWin" mountPath="/" code="91000" desc="Listing directory ended.">
  3467. <parameters path="C:\Share" timeMs="49" entriesCount="511"/>
  3468. </sfs>
  3469. </event>
  3470.  
  3471. <event seq="559" time="2019-02-11 08:17:08.244582 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  3472. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3473. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  3474. <parameters path="C:\Share" type="Directory"/>
  3475. </sfs>
  3476. </event>
  3477.  
  3478. <event seq="560" time="2019-02-11 08:17:08.319172 -0700" app="BvSshServer 8.24" name="I_FTP_DATA_COMPLETED" desc="FTP data connection completed.">
  3479. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3480. <parameters remoteAddress="8.8.8.8:51319" loc="CA/NA" operation="List"/>
  3481. </event>
  3482.  
  3483. <event seq="561" time="2019-02-11 08:17:08.319543 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  3484. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3485. <parameters reply="226 Data connection completed successfully"/>
  3486. </event>
  3487.  
  3488. <event seq="562" time="2019-02-11 08:18:01.364941 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_EOF_RECEIVED" desc="Received EOF on FTP control connection.">
  3489. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3490. <parameters eofType="SocketEof"/>
  3491. </event>
  3492.  
  3493. <event seq="563" time="2019-02-11 08:18:01.370286 -0700" app="BvSshServer 8.24" name="I_SESSION_DISCONNECTED_NORMALLY" desc="Session disconnected normally.">
  3494. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3495. <parameters disconnectReason="EndOfSession" socketBytesReceived="1947" socketBytesSent="49207" payloadBytesReceived="102" payloadBytesSent="46804"/>
  3496. <sessions ssh="0" sshAuth="0" ftp="0" ftpAuth="0"/>
  3497. <help message="The session has ended normally."/>
  3498. </event>
  3499.  
  3500. <event seq="564" time="2019-02-11 08:18:01.370341 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_NO_PROCESS_HANDLE" desc="No process handle supplied.">
  3501. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3502. <parameters processFrom="OnLogonCommand"/>
  3503. </event>
  3504.  
  3505. <event seq="565" time="2019-02-11 08:18:01.370359 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_NO_PROCESS_HANDLE" desc="No process handle supplied.">
  3506. <session id="1016" service="FTP" remoteAddress="8.8.8.8:51318" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3507. <parameters processFrom="OnLogoffCommand"/>
  3508. </event>
  3509.  
  3510. <event seq="566" time="2019-02-11 08:18:01.370973 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_PROCESS_COMPLETED" desc="Process completed; terminating job.">
  3511. <parameters processFrom="FtpSession" exitCode="0"/>
  3512. </event>
  3513.  
  3514. <event seq="567" time="2019-02-11 08:28:13.869151 -0700" app="BvSshServer 8.24" name="I_CONNECT_ACCEPTED" desc="Connection accepted.">
  3515. <session id="1017" service="FTP" remoteAddress="8.8.8.8:51414" loc="CA/NA"/>
  3516. <location continent="North America" country="Canada"/>
  3517. <parameters addressRule="AnyIP" listenAddress="192.168.0.2:21"/>
  3518. <sessions ssh="0" sshAuth="0" ftp="1" ftpAuth="0"/>
  3519. </event>
  3520.  
  3521. <event seq="568" time="2019-02-11 08:28:13.869543 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  3522. <session id="1017" service="FTP" remoteAddress="8.8.8.8:51414" loc="CA/NA"/>
  3523. <parameters reply="220 Bitvise SSH Server 8.24"/>
  3524. </event>
  3525.  
  3526. <event seq="569" time="2019-02-11 08:28:13.869620 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  3527. <session id="1017" service="FTP" remoteAddress="8.8.8.8:51414" loc="CA/NA"/>
  3528. <parameters command="????l???h??�w|!�?��5 8˪n!�?!r��u�*VP��ە?�??:????????�,̩�"/>
  3529. </event>
  3530.  
  3531. <event seq="570" time="2019-02-11 08:28:13.869660 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  3532. <session id="1017" service="FTP" remoteAddress="8.8.8.8:51414" loc="CA/NA"/>
  3533. <parameters reply="500 Unrecognized command"/>
  3534. </event>
  3535.  
  3536. <event seq="571" time="2019-02-11 08:28:13.869681 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  3537. <session id="1017" service="FTP" remoteAddress="8.8.8.8:51414" loc="CA/NA"/>
  3538. <parameters command="���+� ���0̨�?�/�??�?5��?�?/��?�̪?9��?�?3��??????????????"/>
  3539. </event>
  3540.  
  3541. <event seq="572" time="2019-02-11 08:28:13.869700 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  3542. <session id="1017" service="FTP" remoteAddress="8.8.8.8:51414" loc="CA/NA"/>
  3543. <parameters reply="500 Unrecognized command"/>
  3544. </event>
  3545.  
  3546. <event seq="573" time="2019-02-11 08:28:13.869712 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  3547. <session id="1017" service="FTP" remoteAddress="8.8.8.8:51414" loc="CA/NA"/>
  3548. <parameters command="??????????????????????????????? ?????"/>
  3549. </event>
  3550.  
  3551. <event seq="574" time="2019-02-11 08:28:13.869726 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  3552. <session id="1017" service="FTP" remoteAddress="8.8.8.8:51414" loc="CA/NA"/>
  3553. <parameters reply="500 Unrecognized command"/>
  3554. </event>
  3555.  
  3556. <event seq="575" time="2019-02-11 08:28:13.886738 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  3557. <session id="1017" service="FTP" remoteAddress="8.8.8.8:51414" loc="CA/NA"/>
  3558. <parameters reply="421 Internal server error; see server's logs for details"/>
  3559. </event>
  3560.  
  3561. <event seq="576" time="2019-02-11 08:28:14.871196 -0700" app="BvSshServer 8.24" name="I_SESSION_DISCONNECTED_NORMALLY" desc="Session disconnected normally.">
  3562. <session id="1017" service="FTP" remoteAddress="8.8.8.8:51414" loc="CA/NA"/>
  3563. <parameters disconnectReason="Socket" socketBytesReceived="369" socketBytesSent="165" payloadBytesReceived="0" payloadBytesSent="0"/>
  3564. <error type="Flow" component="FtpManager/socketReader" class="WinApi" code="10054" message="An existing connection was forcibly closed by the remote host." description="FlowSocketReader: Error receiving bytes"/>
  3565. </event>
  3566.  
  3567. <event seq="577" time="2019-02-11 08:28:18.802019 -0700" app="BvSshServer 8.24" name="I_CONNECT_ACCEPTED" desc="Connection accepted.">
  3568. <session id="1018" service="FTP" remoteAddress="8.8.8.8:51418" loc="CA/NA"/>
  3569. <location continent="North America" country="Canada"/>
  3570. <parameters addressRule="AnyIP" listenAddress="192.168.0.2:21"/>
  3571. <sessions ssh="0" sshAuth="0" ftp="1" ftpAuth="0"/>
  3572. </event>
  3573.  
  3574. <event seq="578" time="2019-02-11 08:28:18.802447 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  3575. <session id="1018" service="FTP" remoteAddress="8.8.8.8:51418" loc="CA/NA"/>
  3576. <parameters reply="220 Bitvise SSH Server 8.24"/>
  3577. </event>
  3578.  
  3579. <event seq="579" time="2019-02-11 08:28:18.802529 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  3580. <session id="1018" service="FTP" remoteAddress="8.8.8.8:51418" loc="CA/NA"/>
  3581. <parameters command="????l???h??�&lt;H�w?X\լ�?{%'��O���?�4��c��?uQ??:????????�,̩�"/>
  3582. </event>
  3583.  
  3584. <event seq="580" time="2019-02-11 08:28:18.802557 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  3585. <session id="1018" service="FTP" remoteAddress="8.8.8.8:51418" loc="CA/NA"/>
  3586. <parameters reply="500 Unrecognized command"/>
  3587. </event>
  3588.  
  3589. <event seq="581" time="2019-02-11 08:28:18.802573 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  3590. <session id="1018" service="FTP" remoteAddress="8.8.8.8:51418" loc="CA/NA"/>
  3591. <parameters command="���+� ���0̨�?�/�??�?5��?�?/��?�̪?9��?�?3��??????????????"/>
  3592. </event>
  3593.  
  3594. <event seq="582" time="2019-02-11 08:28:18.802589 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  3595. <session id="1018" service="FTP" remoteAddress="8.8.8.8:51418" loc="CA/NA"/>
  3596. <parameters reply="500 Unrecognized command"/>
  3597. </event>
  3598.  
  3599. <event seq="583" time="2019-02-11 08:28:18.802601 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  3600. <session id="1018" service="FTP" remoteAddress="8.8.8.8:51418" loc="CA/NA"/>
  3601. <parameters command="??????????????????????????????? ?????"/>
  3602. </event>
  3603.  
  3604. <event seq="584" time="2019-02-11 08:28:18.802615 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  3605. <session id="1018" service="FTP" remoteAddress="8.8.8.8:51418" loc="CA/NA"/>
  3606. <parameters reply="500 Unrecognized command"/>
  3607. </event>
  3608.  
  3609. <event seq="585" time="2019-02-11 08:28:18.820738 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  3610. <session id="1018" service="FTP" remoteAddress="8.8.8.8:51418" loc="CA/NA"/>
  3611. <parameters reply="421 Internal server error; see server's logs for details"/>
  3612. </event>
  3613.  
  3614. <event seq="586" time="2019-02-11 08:28:19.790431 -0700" app="BvSshServer 8.24" name="I_SESSION_DISCONNECTED_NORMALLY" desc="Session disconnected normally.">
  3615. <session id="1018" service="FTP" remoteAddress="8.8.8.8:51418" loc="CA/NA"/>
  3616. <parameters disconnectReason="Socket" socketBytesReceived="369" socketBytesSent="165" payloadBytesReceived="0" payloadBytesSent="0"/>
  3617. <error type="Flow" component="FtpManager/socketReader" class="WinApi" code="10054" message="An existing connection was forcibly closed by the remote host." description="FlowSocketReader: Error receiving bytes"/>
  3618. </event>
  3619.  
  3620. <event seq="587" time="2019-02-11 08:28:43.781741 -0700" app="BvSshServer 8.24" name="I_CONNECT_ACCEPTED" desc="Connection accepted.">
  3621. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA"/>
  3622. <location continent="North America" country="Canada"/>
  3623. <parameters addressRule="AnyIP" listenAddress="192.168.0.2:22"/>
  3624. <sessions ssh="1" sshAuth="0" ftp="0" ftpAuth="0"/>
  3625. </event>
  3626.  
  3627. <event seq="588" time="2019-02-11 08:28:43.782702 -0700" app="BvSshServer 8.24" name="I_CONNECT_VERSION_RECEIVED" desc="Client version string received.">
  3628. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA"/>
  3629. <parameters clientVersion="SSH-2.0-FileZilla_3.40.0"/>
  3630. </event>
  3631.  
  3632. <event seq="589" time="2019-02-11 08:28:43.782748 -0700" app="BvSshServer 8.24" name="T_CONNECT_CLIENTVERSIONRULE" desc="The client version rule effective for this connection.">
  3633. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA"/>
  3634. <versionRule matchAll="true" accept="true" allowPasswordAuth="true" allowPwKbdiAuth="true" allowGssApiAuth="true" sshUserMustMatchGssApi="true"/>
  3635. </event>
  3636.  
  3637. <event seq="590" time="2019-02-11 08:28:43.782910 -0700" app="BvSshServer 8.24" name="T_SESSION_KEY_EXCHANGE_EVENT" desc="Key exchange event.">
  3638. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA"/>
  3639. <parameters eventType="Start" kexTriggerType="First" kexNr="1"/>
  3640. </event>
  3641.  
  3642. <event seq="591" time="2019-02-11 08:28:43.806361 -0700" app="BvSshServer 8.24" name="T_SESSION_KEY_EXCHANGE_EVENT" desc="Key exchange event.">
  3643. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA"/>
  3644. <parameters eventType="OutDone" kexTriggerType="First" kexNr="1"/>
  3645. </event>
  3646.  
  3647. <event seq="592" time="2019-02-11 08:28:43.835306 -0700" app="BvSshServer 8.24" name="T_SESSION_KEY_EXCHANGE_EVENT" desc="Key exchange event.">
  3648. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA"/>
  3649. <parameters eventType="InDone" kexTriggerType="First" kexNr="1"/>
  3650. </event>
  3651.  
  3652. <event seq="593" time="2019-02-11 08:28:43.835361 -0700" app="BvSshServer 8.24" name="I_SESSION_KEY_EXCHANGE_ALGORITHMS" desc="Key exchange algorithms.">
  3653. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA"/>
  3654. <parameters kexAlg="Curve25519@libssh" cipherAlgIn="aes256-gcm" cipherAlgOut="aes256-gcm" macAlgIn="" macAlgOut="" comprAlgIn="none" comprAlgOut="none"/>
  3655. </event>
  3656.  
  3657. <event seq="594" time="2019-02-11 08:28:43.849340 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_ATTEMPT_STARTED" desc="User authentication attempt started.">
  3658. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA"/>
  3659. <authentication attemptNr="1" userName="testuser" method="none"/>
  3660. </event>
  3661.  
  3662. <event seq="595" time="2019-02-11 08:28:43.849417 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_NONE" desc="The client used the 'none' authentication method. This is used to query available authentication methods.">
  3663. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA"/>
  3664. <authentication attemptNr="1" userName="testuser" method="none"/>
  3665. </event>
  3666.  
  3667. <event seq="596" time="2019-02-11 08:28:43.849452 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_ATTEMPT_ENDED" desc="User authentication attempt ended.">
  3668. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA"/>
  3669. <authentication attemptNr="1" userName="testuser" method="none"/>
  3670. </event>
  3671.  
  3672. <event seq="597" time="2019-02-11 08:28:43.863260 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_ATTEMPT_STARTED" desc="User authentication attempt started.">
  3673. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA"/>
  3674. <authentication attemptNr="1" userName="testuser" method="keyboard-interactive" submethod="None"/>
  3675. </event>
  3676.  
  3677. <event seq="598" time="2019-02-11 08:28:43.863423 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_KBDI_INFO_REQUEST_SENT" desc="Requested information for keyboard-interactive authentication.">
  3678. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA"/>
  3679. <authentication attemptNr="1" serialize="completion" userName="testuser" method="keyboard-interactive" submethod="Password"/>
  3680. <parameters name="Password authentication" instruction="" promptCount="1"/>
  3681. </event>
  3682.  
  3683. <event seq="599" time="2019-02-11 08:28:43.877461 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_KBDI_INFO_RESPONSE_RECEIVED" desc="Received information response for keyboard-interactive authentication.">
  3684. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA"/>
  3685. <authentication attemptNr="1" serialize="completion" userName="testuser" method="keyboard-interactive" submethod="Password" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3686. <parameters responseCount="1"/>
  3687. </event>
  3688.  
  3689. <event seq="600" time="2019-02-11 08:28:43.906340 -0700" app="BvSshServer 8.24" name="T_LOGON_PROCEDURE_TIMING" desc="Logon procedure timing.">
  3690. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA"/>
  3691. <parameters procedure="LogonUser()" timerMs="2"/>
  3692. </event>
  3693.  
  3694. <event seq="601" time="2019-02-11 08:28:43.906386 -0700" app="BvSshServer 8.24" name="T_LOGON_TOKEN_ELEVATION_CHANGE_FAILED" desc="Could not change or obtain user token elevation state.">
  3695. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA"/>
  3696. <parameters desiredElevation="Yes" failureReason="LinkedTokenNotAvailable"/>
  3697. <help message="Elevation state cannot be changed for sessions with the 'network' logon type."/>
  3698. </event>
  3699.  
  3700. <event seq="602" time="2019-02-11 08:28:43.919618 -0700" app="BvSshServer 8.24" name="T_LOGON_PROCEDURE_TIMING" desc="Logon procedure timing.">
  3701. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA"/>
  3702. <parameters procedure="NetUserGetInfo()" timerMs="13"/>
  3703. </event>
  3704.  
  3705. <event seq="603" time="2019-02-11 08:28:43.920202 -0700" app="BvSshServer 8.24" name="I_LOGON_AUTH_SUCCEEDED" desc="User authentication succeeded.">
  3706. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3707. <authentication attemptNr="1" serialize="completion" userName="testuser" method="keyboard-interactive" submethod="Password"/>
  3708. <parameters accountSettings="testuser" groupSettings="Virtual Users" tokenType="LogonUser" tokenLogonType="Network" tokenElevation="Restricted"/>
  3709. </event>
  3710.  
  3711. <event seq="604" time="2019-02-11 08:28:43.920308 -0700" app="BvSshServer 8.24" name="T_LOGON_HOME_DIRECTORY_RETRIEVE_ERROR" desc="Error retrieving home directory.">
  3712. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3713. <error type="WinApi" operation="GetUserProfileDirectory()" code="2" message="The system cannot find the file specified."/>
  3714. </event>
  3715.  
  3716. <event seq="605" time="2019-02-11 08:28:43.921134 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_ATTEMPT_ENDED" desc="User authentication attempt ended.">
  3717. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3718. <authentication attemptNr="1" serialize="completion" userName="testuser" method="keyboard-interactive" submethod="Password"/>
  3719. </event>
  3720.  
  3721. <event seq="606" time="2019-02-11 08:28:43.921385 -0700" app="BvSshServer 8.24" name="T_SESSION_EXTENSIONS" desc="State of session extensions.">
  3722. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3723. <parameters noFlowControl="disabled"/>
  3724. </event>
  3725.  
  3726. <event seq="607" time="2019-02-11 08:28:43.921666 -0700" app="BvSshServer 8.24" name="T_STATS_FILE_READ_COMPLETED" desc="Reading stats file completed.">
  3727. <parameters statsType="VirtGroup" virtualGroup="Virtual Users" file="BssStats-nbvg-Virtual Users-00.xml"/>
  3728. </event>
  3729.  
  3730. <event seq="608" time="2019-02-11 08:28:43.921955 -0700" app="BvSshServer 8.24" name="T_STATS_FILE_READ_COMPLETED" desc="Reading stats file completed.">
  3731. <parameters statsType="VirtAccount" virtualAccount="testuser" file="BssStats-nbva-testuser-00.xml"/>
  3732. </event>
  3733.  
  3734. <event seq="609" time="2019-02-11 08:28:43.935511 -0700" app="BvSshServer 8.24" name="I_CHANNEL_SESSION_OPENED" desc="Session channel opened.">
  3735. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3736. <channel type="session" id="1"/>
  3737. </event>
  3738.  
  3739. <event seq="610" time="2019-02-11 08:28:43.955149 -0700" app="BvSshServer 8.24" name="T_SUBSYS_EXECUTED" desc="SSH server subsystem executed.">
  3740. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3741. <channel type="session" id="1"/>
  3742. <parameters exeFile="SfsServer.exe"/>
  3743. </event>
  3744.  
  3745. <event seq="611" time="2019-02-11 08:28:43.972943 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  3746. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3747. <channel type="session" id="1"/>
  3748. <sfs moduleName="FlowSfsRoot" code="11901" desc="Initializing module with the following settings.">
  3749. <parameters
  3750. settings="Root
  3751. HomePath=/
  3752. CreateHome=No
  3753. ShowRelative=Yes
  3754. DelayInit=Yes
  3755. Provider=FlowSfsWin
  3756. MountPath=/
  3757. MountMode=List,ReadExist,WriteExist,ReadWriteDeleteNew,CreateDir,CreateLink
  3758. RootPath=C:\Share
  3759. CreateRoot=No
  3760. MaxPathLength=3000
  3761. DelayInit=Yes
  3762. ShowEmptyDir=IfNoAccess
  3763. FileShareBeh=Default
  3764. FileShare=Read,Write
  3765. OwnerGroup=IfUnknown-Default
  3766. Acl=IfUnknownAce-DefaultAcl"/>
  3767. </sfs>
  3768. </event>
  3769.  
  3770. <event seq="612" time="2019-02-11 08:28:43.972991 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  3771. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3772. <channel type="session" id="1"/>
  3773. <sfs moduleName="FlowSfsRoot" code="11000" desc="Initializing module succeeded."/>
  3774. </event>
  3775.  
  3776. <event seq="613" time="2019-02-11 08:28:43.973008 -0700" app="BvSshServer 8.24" name="I_SFTP_SERVER_VERSION_NEGOTIATED" desc="SFTP protocol version negotiated.">
  3777. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3778. <channel type="session" id="1"/>
  3779. <parameters versionRequested="3" versionSelected="3"/>
  3780. </event>
  3781.  
  3782. <event seq="614" time="2019-02-11 08:28:43.988081 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  3783. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3784. <channel type="session" id="1"/>
  3785. <sfs moduleName="FlowSfsRoot" code="31904" desc="Paths processed.">
  3786. <parameters pathRaw="." path="/"/>
  3787. <handler moduleName="FlowSfsWin" mountPath="/"/>
  3788. </sfs>
  3789. </event>
  3790.  
  3791. <event seq="615" time="2019-02-11 08:28:43.988113 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  3792. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3793. <channel type="session" id="1"/>
  3794. <sfs moduleName="FlowSfsWin" mountPath="/" code="11000" desc="Initializing module succeeded."/>
  3795. </event>
  3796.  
  3797. <event seq="616" time="2019-02-11 08:28:43.988185 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  3798. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3799. <channel type="session" id="1"/>
  3800. <sfs moduleName="FlowSfsWin" mountPath="/" code="31000" desc="Querying real path succeeded.">
  3801. <parameters path="C:\Share" controlByte="NoCheck"/>
  3802. </sfs>
  3803. </event>
  3804.  
  3805. <event seq="617" time="2019-02-11 08:28:44.003662 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  3806. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3807. <channel type="session" id="1"/>
  3808. <sfs moduleName="FlowSfsRoot" code="31904" desc="Paths processed.">
  3809. <parameters pathRaw="/." path="/"/>
  3810. <handler moduleName="FlowSfsWin" mountPath="/"/>
  3811. </sfs>
  3812. </event>
  3813.  
  3814. <event seq="618" time="2019-02-11 08:28:44.003692 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  3815. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3816. <channel type="session" id="1"/>
  3817. <sfs moduleName="FlowSfsWin" mountPath="/" code="31000" desc="Querying real path succeeded.">
  3818. <parameters path="C:\Share" controlByte="NoCheck"/>
  3819. </sfs>
  3820. </event>
  3821.  
  3822. <event seq="619" time="2019-02-11 08:28:44.018773 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  3823. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3824. <channel type="session" id="1"/>
  3825. <sfs moduleName="FlowSfsRoot" code="26904" desc="Paths processed.">
  3826. <parameters pathRaw="/" path="/"/>
  3827. <handler moduleName="FlowSfsWin" mountPath="/"/>
  3828. </sfs>
  3829. </event>
  3830.  
  3831. <event seq="620" time="2019-02-11 08:28:44.018803 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  3832. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3833. <channel type="session" id="1"/>
  3834. <sfs moduleName="FlowSfsWin" mountPath="/" code="26000" desc="Opening directory succeeded.">
  3835. <parameters path="C:\Share"/>
  3836. </sfs>
  3837. </event>
  3838.  
  3839. <event seq="621" time="2019-02-11 08:28:44.035041 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  3840. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3841. <channel type="session" id="1"/>
  3842. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  3843. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  3844. </sfs>
  3845. </event>
  3846.  
  3847. <event seq="622" time="2019-02-11 08:28:44.035071 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  3848. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3849. <channel type="session" id="1"/>
  3850. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  3851. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  3852. </sfs>
  3853. </event>
  3854.  
  3855. <event seq="623" time="2019-02-11 08:28:44.037149 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  3856. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3857. <channel type="session" id="1"/>
  3858. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  3859. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  3860. </sfs>
  3861. </event>
  3862.  
  3863. <event seq="624" time="2019-02-11 08:28:44.037180 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  3864. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3865. <channel type="session" id="1"/>
  3866. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  3867. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  3868. </sfs>
  3869. </event>
  3870.  
  3871. <event seq="625" time="2019-02-11 08:28:44.065200 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  3872. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3873. <channel type="session" id="1"/>
  3874. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  3875. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  3876. </sfs>
  3877. </event>
  3878.  
  3879. <event seq="626" time="2019-02-11 08:28:44.078872 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  3880. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3881. <channel type="session" id="1"/>
  3882. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  3883. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  3884. </sfs>
  3885. </event>
  3886.  
  3887. <event seq="627" time="2019-02-11 08:28:44.079757 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  3888. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3889. <channel type="session" id="1"/>
  3890. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  3891. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  3892. </sfs>
  3893. </event>
  3894.  
  3895. <event seq="628" time="2019-02-11 08:28:44.080890 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  3896. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3897. <channel type="session" id="1"/>
  3898. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  3899. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  3900. </sfs>
  3901. </event>
  3902.  
  3903. <event seq="629" time="2019-02-11 08:28:44.093347 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  3904. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3905. <channel type="session" id="1"/>
  3906. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  3907. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  3908. </sfs>
  3909. </event>
  3910.  
  3911. <event seq="630" time="2019-02-11 08:28:44.095430 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  3912. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3913. <channel type="session" id="1"/>
  3914. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  3915. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  3916. </sfs>
  3917. </event>
  3918.  
  3919. <event seq="631" time="2019-02-11 08:28:44.095814 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  3920. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3921. <channel type="session" id="1"/>
  3922. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  3923. <parameters path="C:\Share" entriesCount="11" reachedEof="true"/>
  3924. </sfs>
  3925. </event>
  3926.  
  3927. <event seq="632" time="2019-02-11 08:28:44.107254 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  3928. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3929. <channel type="session" id="1"/>
  3930. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  3931. <parameters path="C:\Share" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  3932. </sfs>
  3933. </event>
  3934.  
  3935. <event seq="633" time="2019-02-11 08:28:44.108854 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  3936. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3937. <channel type="session" id="1"/>
  3938. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  3939. <parameters path="C:\Share" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  3940. </sfs>
  3941. </event>
  3942.  
  3943. <event seq="634" time="2019-02-11 08:28:44.110863 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  3944. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3945. <channel type="session" id="1"/>
  3946. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  3947. <parameters path="C:\Share" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  3948. </sfs>
  3949. </event>
  3950.  
  3951. <event seq="635" time="2019-02-11 08:28:44.120625 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  3952. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3953. <channel type="session" id="1"/>
  3954. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  3955. <parameters path="C:\Share" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  3956. </sfs>
  3957. </event>
  3958.  
  3959. <event seq="636" time="2019-02-11 08:28:44.134718 -0700" app="BvSshServer 8.24" name="I_SFS_LIST_DIRECTORY" desc="Virtual filesystem: list directory.">
  3960. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3961. <channel type="session" id="1"/>
  3962. <sfs moduleName="FlowSfsWin" mountPath="/" code="91000" desc="Listing directory ended.">
  3963. <parameters path="C:\Share" timeMs="116" entriesCount="511"/>
  3964. </sfs>
  3965. </event>
  3966.  
  3967. <event seq="637" time="2019-02-11 08:28:44.134748 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  3968. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  3969. <channel type="session" id="1"/>
  3970. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  3971. <parameters path="C:\Share" type="Directory"/>
  3972. </sfs>
  3973. </event>
  3974.  
  3975. <event seq="638" time="2019-02-11 08:28:47.105730 -0700" app="BvSshServer 8.24" name="I_CONNECT_ACCEPTED" desc="Connection accepted.">
  3976. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA"/>
  3977. <location continent="North America" country="Canada"/>
  3978. <parameters addressRule="AnyIP" listenAddress="192.168.0.2:21"/>
  3979. <sessions ssh="1" sshAuth="1" ftp="1" ftpAuth="0"/>
  3980. </event>
  3981.  
  3982. <event seq="639" time="2019-02-11 08:28:47.106097 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  3983. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA"/>
  3984. <parameters reply="220 Bitvise SSH Server 8.24"/>
  3985. </event>
  3986.  
  3987. <event seq="640" time="2019-02-11 08:28:47.120318 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  3988. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA"/>
  3989. <parameters command="AUTH TLS"/>
  3990. </event>
  3991.  
  3992. <event seq="641" time="2019-02-11 08:28:47.120356 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  3993. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA"/>
  3994. <parameters reply="234 Security mechanism set to TLS"/>
  3995. </event>
  3996.  
  3997. <event seq="642" time="2019-02-11 08:28:47.197527 -0700" app="BvSshServer 8.24" name="I_FTP_CONTROL_TLS_NEGOTIATED" desc="TLS algorithms for FTP control connection negotiated.">
  3998. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA"/>
  3999. <parameters negNr="1" protocol="TLS 1.2" cipherSuite="TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256"/>
  4000. </event>
  4001.  
  4002. <event seq="643" time="2019-02-11 08:28:47.255515 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  4003. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA"/>
  4004. <parameters command="USER testuser"/>
  4005. </event>
  4006.  
  4007. <event seq="644" time="2019-02-11 08:28:47.255577 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4008. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA"/>
  4009. <parameters reply="331 Need password"/>
  4010. </event>
  4011.  
  4012. <event seq="645" time="2019-02-11 08:28:47.269279 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  4013. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA"/>
  4014. <parameters command="PASS ***"/>
  4015. </event>
  4016.  
  4017. <event seq="646" time="2019-02-11 08:28:47.269314 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_ATTEMPT_STARTED" desc="User authentication attempt started.">
  4018. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA"/>
  4019. <authentication attemptNr="1" userName="testuser" method="password"/>
  4020. </event>
  4021.  
  4022. <event seq="647" time="2019-02-11 08:28:47.297914 -0700" app="BvSshServer 8.24" name="T_LOGON_PROCEDURE_TIMING" desc="Logon procedure timing.">
  4023. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA"/>
  4024. <parameters procedure="LogonUser()" timerMs="1"/>
  4025. </event>
  4026.  
  4027. <event seq="648" time="2019-02-11 08:28:47.297953 -0700" app="BvSshServer 8.24" name="T_LOGON_TOKEN_ELEVATION_CHANGE_FAILED" desc="Could not change or obtain user token elevation state.">
  4028. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA"/>
  4029. <parameters desiredElevation="Yes" failureReason="LinkedTokenNotAvailable"/>
  4030. <help message="Elevation state cannot be changed for sessions with the 'network' logon type."/>
  4031. </event>
  4032.  
  4033. <event seq="649" time="2019-02-11 08:28:47.303972 -0700" app="BvSshServer 8.24" name="T_LOGON_PROCEDURE_TIMING" desc="Logon procedure timing.">
  4034. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA"/>
  4035. <parameters procedure="NetUserGetInfo()" timerMs="5"/>
  4036. </event>
  4037.  
  4038. <event seq="650" time="2019-02-11 08:28:47.304550 -0700" app="BvSshServer 8.24" name="I_LOGON_AUTH_SUCCEEDED" desc="User authentication succeeded.">
  4039. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4040. <authentication attemptNr="1" serialize="completion" userName="testuser" method="password"/>
  4041. <parameters accountSettings="testuser" groupSettings="Virtual Users" tokenType="LogonUser" tokenLogonType="Network" tokenElevation="Restricted"/>
  4042. </event>
  4043.  
  4044. <event seq="651" time="2019-02-11 08:28:47.304654 -0700" app="BvSshServer 8.24" name="T_LOGON_HOME_DIRECTORY_RETRIEVE_ERROR" desc="Error retrieving home directory.">
  4045. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4046. <error type="WinApi" operation="GetUserProfileDirectory()" code="2" message="The system cannot find the file specified."/>
  4047. </event>
  4048.  
  4049. <event seq="652" time="2019-02-11 08:28:47.305505 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_ATTEMPT_ENDED" desc="User authentication attempt ended.">
  4050. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4051. <authentication attemptNr="1" serialize="completion" userName="testuser" method="password"/>
  4052. </event>
  4053.  
  4054. <event seq="653" time="2019-02-11 08:28:47.305542 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4055. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4056. <parameters reply="230 User logged in"/>
  4057. </event>
  4058.  
  4059. <event seq="654" time="2019-02-11 08:28:47.310338 -0700" app="BvSshServer 8.24" name="T_SUBSYS_EXECUTED" desc="SSH server subsystem executed.">
  4060. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4061. <parameters exeFile="SfsServer.exe"/>
  4062. </event>
  4063.  
  4064. <event seq="655" time="2019-02-11 08:28:47.328199 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  4065. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4066. <sfs moduleName="FlowSfsRoot" code="11901" desc="Initializing module with the following settings.">
  4067. <parameters
  4068. settings="Root
  4069. HomePath=/
  4070. CreateHome=No
  4071. ShowRelative=Yes
  4072. DelayInit=Yes
  4073. Provider=FlowSfsWin
  4074. MountPath=/
  4075. MountMode=List,ReadExist,WriteExist,ReadWriteDeleteNew,CreateDir,CreateLink
  4076. RootPath=C:\Share
  4077. CreateRoot=No
  4078. MaxPathLength=3000
  4079. DelayInit=Yes
  4080. ShowEmptyDir=IfNoAccess
  4081. FileShareBeh=Default
  4082. FileShare=Read,Write
  4083. OwnerGroup=IfUnknown-Default
  4084. Acl=IfUnknownAce-DefaultAcl"/>
  4085. </sfs>
  4086. </event>
  4087.  
  4088. <event seq="656" time="2019-02-11 08:28:47.328245 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  4089. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4090. <sfs moduleName="FlowSfsRoot" code="11000" desc="Initializing module succeeded."/>
  4091. </event>
  4092.  
  4093. <event seq="657" time="2019-02-11 08:28:47.328268 -0700" app="BvSshServer 8.24" name="I_SFS_QUERY_HOME_DIRECTORY" desc="Virtual filesystem: query home directory.">
  4094. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4095. <sfs moduleName="FlowSfsRoot" code="40000" desc="Querying home directory succeeded.">
  4096. <parameters homePath="/"/>
  4097. </sfs>
  4098. </event>
  4099.  
  4100. <event seq="658" time="2019-02-11 08:28:47.328351 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  4101. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4102. <parameters command="SYST"/>
  4103. </event>
  4104.  
  4105. <event seq="659" time="2019-02-11 08:28:47.328377 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4106. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4107. <parameters reply="215 UNIX"/>
  4108. </event>
  4109.  
  4110. <event seq="660" time="2019-02-11 08:28:47.343684 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  4111. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4112. <parameters command="FEAT"/>
  4113. </event>
  4114.  
  4115. <event seq="661" time="2019-02-11 08:28:47.343719 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4116. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4117. <parameters
  4118. reply="211-Features:
  4119. LANG EN*
  4120. UTF8
  4121. MDTM
  4122. SIZE
  4123. REST STREAM
  4124. TVFS
  4125. AUTH TLS
  4126. AUTH SSL
  4127. PROT
  4128. PBSZ
  4129. EPSV
  4130. HASH SHA-512;SHA-256;SHA-1*;MD5;CRC32
  4131. XCRC &quot;filename&quot; SP EP
  4132. XMD5 &quot;filename&quot; SP EP
  4133. XSHA &quot;filename&quot; SP EP
  4134. XSHA1 &quot;filename&quot; SP EP
  4135. XSHA256 &quot;filename&quot; SP EP
  4136. XSHA512 &quot;filename&quot; SP EP
  4137. 211 End"/>
  4138. </event>
  4139.  
  4140. <event seq="662" time="2019-02-11 08:28:47.358547 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  4141. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4142. <parameters command="OPTS UTF8 ON"/>
  4143. </event>
  4144.  
  4145. <event seq="663" time="2019-02-11 08:28:47.358579 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4146. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4147. <parameters reply="202 The UTF8 option is already enabled"/>
  4148. </event>
  4149.  
  4150. <event seq="664" time="2019-02-11 08:28:47.373256 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  4151. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4152. <parameters command="PBSZ 0"/>
  4153. </event>
  4154.  
  4155. <event seq="665" time="2019-02-11 08:28:47.373284 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4156. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4157. <parameters reply="200 PBSZ=0"/>
  4158. </event>
  4159.  
  4160. <event seq="666" time="2019-02-11 08:28:47.387270 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  4161. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4162. <parameters command="PROT P"/>
  4163. </event>
  4164.  
  4165. <event seq="667" time="2019-02-11 08:28:47.387297 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4166. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4167. <parameters reply="200 Data protection level set to Private"/>
  4168. </event>
  4169.  
  4170. <event seq="668" time="2019-02-11 08:28:47.403693 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  4171. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4172. <parameters command="PWD"/>
  4173. </event>
  4174.  
  4175. <event seq="669" time="2019-02-11 08:28:47.403723 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4176. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4177. <parameters reply="257 &quot;/&quot; is current directory"/>
  4178. </event>
  4179.  
  4180. <event seq="670" time="2019-02-11 08:28:47.417640 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  4181. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4182. <parameters command="TYPE I"/>
  4183. </event>
  4184.  
  4185. <event seq="671" time="2019-02-11 08:28:47.417673 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4186. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4187. <parameters reply="200 Representation type set to Image"/>
  4188. </event>
  4189.  
  4190. <event seq="672" time="2019-02-11 08:28:47.431431 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  4191. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4192. <parameters command="PASV"/>
  4193. </event>
  4194.  
  4195. <event seq="673" time="2019-02-11 08:28:47.431661 -0700" app="BvSshServer 8.24" name="T_FTP_DATA_ACCEPT_STARTED" desc="Passive FTP data connection attempt started.">
  4196. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4197. <parameters listenAddress="0.0.0.0:61001" replyAddress="74.3.185.50:61001"/>
  4198. </event>
  4199.  
  4200. <event seq="674" time="2019-02-11 08:28:47.431741 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4201. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4202. <parameters reply="227 Entering Passive Mode (74,3,185,50,238,73)"/>
  4203. </event>
  4204.  
  4205. <event seq="675" time="2019-02-11 08:28:47.445327 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  4206. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4207. <parameters command="LIST"/>
  4208. </event>
  4209.  
  4210. <event seq="676" time="2019-02-11 08:28:47.446369 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  4211. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4212. <sfs moduleName="FlowSfsRoot" code="26904" desc="Paths processed.">
  4213. <parameters pathRaw="/" path="/"/>
  4214. <handler moduleName="FlowSfsWin" mountPath="/"/>
  4215. </sfs>
  4216. </event>
  4217.  
  4218. <event seq="677" time="2019-02-11 08:28:47.446403 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  4219. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4220. <sfs moduleName="FlowSfsWin" mountPath="/" code="11000" desc="Initializing module succeeded."/>
  4221. </event>
  4222.  
  4223. <event seq="678" time="2019-02-11 08:28:47.446490 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  4224. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4225. <sfs moduleName="FlowSfsWin" mountPath="/" code="26000" desc="Opening directory succeeded.">
  4226. <parameters path="C:\Share"/>
  4227. </sfs>
  4228. </event>
  4229.  
  4230. <event seq="679" time="2019-02-11 08:28:47.446589 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4231. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4232. <parameters reply="150 Opening data connection"/>
  4233. </event>
  4234.  
  4235. <event seq="680" time="2019-02-11 08:28:47.461639 -0700" app="BvSshServer 8.24" name="I_FTP_PASV_DISPATCHER_DATA_ACCEPTED" desc="FTP passive data connection accepted.">
  4236. <parameters remoteAddress="8.8.8.8:51421" loc="CA/NA" listenAddress="0.0.0.0:61001" addressRule="AnyIP"/>
  4237. </event>
  4238.  
  4239. <event seq="681" time="2019-02-11 08:28:47.462130 -0700" app="BvSshServer 8.24" name="T_FTP_PASV_DISPATCHER_DATA_DISPATCHED" desc="FTP passive data connection dispatched to the FTP session.">
  4240. <parameters remoteAddress="8.8.8.8:51421" loc="CA/NA" listenAddress="0.0.0.0:61001" sessionId="1020"/>
  4241. </event>
  4242.  
  4243. <event seq="682" time="2019-02-11 08:28:47.462243 -0700" app="BvSshServer 8.24" name="I_FTP_DATA_ACCEPTED" desc="Passive FTP data connection accepted.">
  4244. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4245. <parameters remoteAddress="8.8.8.8:51421" loc="CA/NA" listenAddress="0.0.0.0:61001" operation="List"/>
  4246. </event>
  4247.  
  4248. <event seq="683" time="2019-02-11 08:28:47.478063 -0700" app="BvSshServer 8.24" name="I_FTP_DATA_TLS_NEGOTIATED" desc="TLS algorithms for FTP data connection negotiated.">
  4249. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4250. <parameters remoteAddress="8.8.8.8:51421" loc="CA/NA" operation="List" negNr="1" protocol="TLS 1.2" cipherSuite="TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256"/>
  4251. </event>
  4252.  
  4253. <event seq="684" time="2019-02-11 08:28:47.479775 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  4254. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4255. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  4256. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  4257. </sfs>
  4258. </event>
  4259.  
  4260. <event seq="685" time="2019-02-11 08:28:47.479815 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  4261. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4262. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  4263. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  4264. </sfs>
  4265. </event>
  4266.  
  4267. <event seq="686" time="2019-02-11 08:28:47.481322 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  4268. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4269. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  4270. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  4271. </sfs>
  4272. </event>
  4273.  
  4274. <event seq="687" time="2019-02-11 08:28:47.481352 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  4275. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4276. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  4277. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  4278. </sfs>
  4279. </event>
  4280.  
  4281. <event seq="688" time="2019-02-11 08:28:47.484159 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  4282. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4283. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  4284. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  4285. </sfs>
  4286. </event>
  4287.  
  4288. <event seq="689" time="2019-02-11 08:28:47.485954 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  4289. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4290. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  4291. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  4292. </sfs>
  4293. </event>
  4294.  
  4295. <event seq="690" time="2019-02-11 08:28:47.485986 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  4296. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4297. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  4298. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  4299. </sfs>
  4300. </event>
  4301.  
  4302. <event seq="691" time="2019-02-11 08:28:47.486011 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  4303. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4304. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  4305. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  4306. </sfs>
  4307. </event>
  4308.  
  4309. <event seq="692" time="2019-02-11 08:28:47.488219 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  4310. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4311. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  4312. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  4313. </sfs>
  4314. </event>
  4315.  
  4316. <event seq="693" time="2019-02-11 08:28:47.490327 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  4317. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4318. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  4319. <parameters path="C:\Share" entriesCount="50" reachedEof="false"/>
  4320. </sfs>
  4321. </event>
  4322.  
  4323. <event seq="694" time="2019-02-11 08:28:47.490366 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  4324. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4325. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  4326. <parameters path="C:\Share" entriesCount="11" reachedEof="true"/>
  4327. </sfs>
  4328. </event>
  4329.  
  4330. <event seq="695" time="2019-02-11 08:28:47.491580 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  4331. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4332. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  4333. <parameters path="C:\Share" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  4334. </sfs>
  4335. </event>
  4336.  
  4337. <event seq="696" time="2019-02-11 08:28:47.491630 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  4338. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4339. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  4340. <parameters path="C:\Share" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  4341. </sfs>
  4342. </event>
  4343.  
  4344. <event seq="697" time="2019-02-11 08:28:47.492264 -0700" app="BvSshServer 8.24" name="I_SFS_LIST_DIRECTORY" desc="Virtual filesystem: list directory.">
  4345. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4346. <sfs moduleName="FlowSfsWin" mountPath="/" code="91000" desc="Listing directory ended.">
  4347. <parameters path="C:\Share" timeMs="46" entriesCount="511"/>
  4348. </sfs>
  4349. </event>
  4350.  
  4351. <event seq="698" time="2019-02-11 08:28:47.492292 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  4352. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4353. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  4354. <parameters path="C:\Share" type="Directory"/>
  4355. </sfs>
  4356. </event>
  4357.  
  4358. <event seq="699" time="2019-02-11 08:28:47.659003 -0700" app="BvSshServer 8.24" name="I_FTP_DATA_COMPLETED" desc="FTP data connection completed.">
  4359. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4360. <parameters remoteAddress="8.8.8.8:51421" loc="CA/NA" operation="List"/>
  4361. </event>
  4362.  
  4363. <event seq="700" time="2019-02-11 08:28:47.659107 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4364. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4365. <parameters reply="226 Data connection completed successfully"/>
  4366. </event>
  4367.  
  4368. <event seq="701" time="2019-02-11 08:43:41.232501 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  4369. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4370. <parameters command="CWD ProjectA"/>
  4371. </event>
  4372.  
  4373. <event seq="702" time="2019-02-11 08:43:41.233141 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  4374. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4375. <sfs moduleName="FlowSfsRoot" code="31904" desc="Paths processed.">
  4376. <parameters pathRaw="/ProjectA" path="/ProjectA"/>
  4377. <handler moduleName="FlowSfsWin" mountPath="/"/>
  4378. </sfs>
  4379. </event>
  4380.  
  4381. <event seq="703" time="2019-02-11 08:43:41.233184 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  4382. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4383. <sfs moduleName="FlowSfsWin" mountPath="/" code="31000" desc="Querying real path succeeded.">
  4384. <parameters path="C:\Share\ProjectA" controlByte="NoCheck"/>
  4385. </sfs>
  4386. </event>
  4387.  
  4388. <event seq="704" time="2019-02-11 08:43:41.233841 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  4389. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4390. <sfs moduleName="FlowSfsRoot" code="26904" desc="Paths processed.">
  4391. <parameters pathRaw="/ProjectA" path="/ProjectA"/>
  4392. <handler moduleName="FlowSfsWin" mountPath="/"/>
  4393. </sfs>
  4394. </event>
  4395.  
  4396. <event seq="705" time="2019-02-11 08:43:41.233882 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  4397. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4398. <sfs moduleName="FlowSfsWin" mountPath="/" code="26000" desc="Opening directory succeeded.">
  4399. <parameters path="C:\Share\ProjectA"/>
  4400. </sfs>
  4401. </event>
  4402.  
  4403. <event seq="706" time="2019-02-11 08:43:41.234322 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  4404. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4405. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  4406. <parameters path="C:\Share\ProjectA" type="Directory"/>
  4407. </sfs>
  4408. </event>
  4409.  
  4410. <event seq="707" time="2019-02-11 08:43:41.234386 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4411. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4412. <parameters reply="250 &quot;/ProjectA&quot; is current directory"/>
  4413. </event>
  4414.  
  4415. <event seq="708" time="2019-02-11 08:43:41.249387 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  4416. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4417. <parameters command="PWD"/>
  4418. </event>
  4419.  
  4420. <event seq="709" time="2019-02-11 08:43:41.249419 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4421. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4422. <parameters reply="257 &quot;/ProjectA&quot; is current directory"/>
  4423. </event>
  4424.  
  4425. <event seq="710" time="2019-02-11 08:43:41.264382 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  4426. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4427. <parameters command="PASV"/>
  4428. </event>
  4429.  
  4430. <event seq="711" time="2019-02-11 08:43:41.264535 -0700" app="BvSshServer 8.24" name="T_FTP_DATA_ACCEPT_STARTED" desc="Passive FTP data connection attempt started.">
  4431. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4432. <parameters listenAddress="0.0.0.0:61001" replyAddress="74.3.185.50:61001"/>
  4433. </event>
  4434.  
  4435. <event seq="712" time="2019-02-11 08:43:41.264600 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4436. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4437. <parameters reply="227 Entering Passive Mode (74,3,185,50,238,73)"/>
  4438. </event>
  4439.  
  4440. <event seq="713" time="2019-02-11 08:43:41.281379 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  4441. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4442. <parameters command="LIST"/>
  4443. </event>
  4444.  
  4445. <event seq="714" time="2019-02-11 08:43:41.281870 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  4446. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4447. <sfs moduleName="FlowSfsRoot" code="26904" desc="Paths processed.">
  4448. <parameters pathRaw="/ProjectA" path="/ProjectA"/>
  4449. <handler moduleName="FlowSfsWin" mountPath="/"/>
  4450. </sfs>
  4451. </event>
  4452.  
  4453. <event seq="715" time="2019-02-11 08:43:41.281904 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  4454. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4455. <sfs moduleName="FlowSfsWin" mountPath="/" code="26000" desc="Opening directory succeeded.">
  4456. <parameters path="C:\Share\ProjectA"/>
  4457. </sfs>
  4458. </event>
  4459.  
  4460. <event seq="716" time="2019-02-11 08:43:41.282016 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4461. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4462. <parameters reply="150 Opening data connection"/>
  4463. </event>
  4464.  
  4465. <event seq="717" time="2019-02-11 08:43:41.301803 -0700" app="BvSshServer 8.24" name="I_FTP_PASV_DISPATCHER_DATA_ACCEPTED" desc="FTP passive data connection accepted.">
  4466. <parameters remoteAddress="8.8.8.8:51474" loc="CA/NA" listenAddress="0.0.0.0:61001" addressRule="AnyIP"/>
  4467. </event>
  4468.  
  4469. <event seq="718" time="2019-02-11 08:43:41.302338 -0700" app="BvSshServer 8.24" name="T_FTP_PASV_DISPATCHER_DATA_DISPATCHED" desc="FTP passive data connection dispatched to the FTP session.">
  4470. <parameters remoteAddress="8.8.8.8:51474" loc="CA/NA" listenAddress="0.0.0.0:61001" sessionId="1020"/>
  4471. </event>
  4472.  
  4473. <event seq="719" time="2019-02-11 08:43:41.302455 -0700" app="BvSshServer 8.24" name="I_FTP_DATA_ACCEPTED" desc="Passive FTP data connection accepted.">
  4474. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4475. <parameters remoteAddress="8.8.8.8:51474" loc="CA/NA" listenAddress="0.0.0.0:61001" operation="List"/>
  4476. </event>
  4477.  
  4478. <event seq="720" time="2019-02-11 08:43:41.317589 -0700" app="BvSshServer 8.24" name="I_FTP_DATA_TLS_NEGOTIATED" desc="TLS algorithms for FTP data connection negotiated.">
  4479. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4480. <parameters remoteAddress="8.8.8.8:51474" loc="CA/NA" operation="List" negNr="1" protocol="TLS 1.2" cipherSuite="TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256"/>
  4481. </event>
  4482.  
  4483. <event seq="721" time="2019-02-11 08:43:41.318458 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  4484. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4485. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  4486. <parameters path="C:\Share\ProjectA" entriesCount="8" reachedEof="true"/>
  4487. </sfs>
  4488. </event>
  4489.  
  4490. <event seq="722" time="2019-02-11 08:43:41.318503 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  4491. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4492. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  4493. <parameters path="C:\Share\ProjectA" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  4494. </sfs>
  4495. </event>
  4496.  
  4497. <event seq="723" time="2019-02-11 08:43:41.318527 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  4498. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4499. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  4500. <parameters path="C:\Share\ProjectA" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  4501. </sfs>
  4502. </event>
  4503.  
  4504. <event seq="724" time="2019-02-11 08:43:41.318629 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  4505. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4506. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  4507. <parameters path="C:\Share\ProjectA" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  4508. </sfs>
  4509. </event>
  4510.  
  4511. <event seq="725" time="2019-02-11 08:43:41.31216 -0700" app="BvSshServer 8.24" name="I_SFS_LIST_DIRECTORY" desc="Virtual filesystem: list directory.">
  4512. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4513. <sfs moduleName="FlowSfsWin" mountPath="/" code="91000" desc="Listing directory ended.">
  4514. <parameters path="C:\Share\ProjectA" timeMs="38" entriesCount="8"/>
  4515. </sfs>
  4516. </event>
  4517.  
  4518. <event seq="726" time="2019-02-11 08:43:41.319948 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  4519. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4520. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  4521. <parameters path="C:\Share\ProjectA" type="Directory"/>
  4522. </sfs>
  4523. </event>
  4524.  
  4525. <event seq="727" time="2019-02-11 08:43:41.338851 -0700" app="BvSshServer 8.24" name="I_FTP_DATA_COMPLETED" desc="FTP data connection completed.">
  4526. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4527. <parameters remoteAddress="8.8.8.8:51474" loc="CA/NA" operation="List"/>
  4528. </event>
  4529.  
  4530. <event seq="728" time="2019-02-11 08:43:41.338946 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4531. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4532. <parameters reply="226 Data connection completed successfully"/>
  4533. </event>
  4534.  
  4535. <event seq="729" time="2019-02-11 08:43:41.957116 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  4536. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4537. <parameters command="CWD Eng"/>
  4538. </event>
  4539.  
  4540. <event seq="730" time="2019-02-11 08:43:41.957667 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  4541. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4542. <sfs moduleName="FlowSfsRoot" code="31904" desc="Paths processed.">
  4543. <parameters pathRaw="/ProjectA/Eng" path="/ProjectA/Eng"/>
  4544. <handler moduleName="FlowSfsWin" mountPath="/"/>
  4545. </sfs>
  4546. </event>
  4547.  
  4548. <event seq="731" time="2019-02-11 08:43:41.957708 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  4549. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4550. <sfs moduleName="FlowSfsWin" mountPath="/" code="31000" desc="Querying real path succeeded.">
  4551. <parameters path="C:\Share\ProjectA\Eng" controlByte="NoCheck"/>
  4552. </sfs>
  4553. </event>
  4554.  
  4555. <event seq="732" time="2019-02-11 08:43:41.958779 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  4556. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4557. <sfs moduleName="FlowSfsRoot" code="26904" desc="Paths processed.">
  4558. <parameters pathRaw="/ProjectA/Eng" path="/ProjectA/Eng"/>
  4559. <handler moduleName="FlowSfsWin" mountPath="/"/>
  4560. </sfs>
  4561. </event>
  4562.  
  4563. <event seq="733" time="2019-02-11 08:43:41.958817 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  4564. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4565. <sfs moduleName="FlowSfsWin" mountPath="/" code="26000" desc="Opening directory succeeded.">
  4566. <parameters path="C:\Share\ProjectA\Eng"/>
  4567. </sfs>
  4568. </event>
  4569.  
  4570. <event seq="734" time="2019-02-11 08:43:41.959260 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  4571. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4572. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  4573. <parameters path="C:\Share\ProjectA\Eng" type="Directory"/>
  4574. </sfs>
  4575. </event>
  4576.  
  4577. <event seq="735" time="2019-02-11 08:43:41.959331 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4578. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4579. <parameters reply="250 &quot;/ProjectA/Eng&quot; is current directory"/>
  4580. </event>
  4581.  
  4582. <event seq="736" time="2019-02-11 08:43:41.973858 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  4583. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4584. <parameters command="PWD"/>
  4585. </event>
  4586.  
  4587. <event seq="737" time="2019-02-11 08:43:41.973892 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4588. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4589. <parameters reply="257 &quot;/ProjectA/Eng&quot; is current directory"/>
  4590. </event>
  4591.  
  4592. <event seq="738" time="2019-02-11 08:43:42.088484 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  4593. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4594. <parameters command="PASV"/>
  4595. </event>
  4596.  
  4597. <event seq="739" time="2019-02-11 08:43:42.088627 -0700" app="BvSshServer 8.24" name="T_FTP_DATA_ACCEPT_STARTED" desc="Passive FTP data connection attempt started.">
  4598. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4599. <parameters listenAddress="0.0.0.0:61001" replyAddress="74.3.185.50:61001"/>
  4600. </event>
  4601.  
  4602. <event seq="740" time="2019-02-11 08:43:42.088693 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4603. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4604. <parameters reply="227 Entering Passive Mode (74,3,185,50,238,73)"/>
  4605. </event>
  4606.  
  4607. <event seq="741" time="2019-02-11 08:43:42.102381 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  4608. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4609. <parameters command="LIST"/>
  4610. </event>
  4611.  
  4612. <event seq="742" time="2019-02-11 08:43:42.102891 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  4613. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4614. <sfs moduleName="FlowSfsRoot" code="26904" desc="Paths processed.">
  4615. <parameters pathRaw="/ProjectA/Eng" path="/ProjectA/Eng"/>
  4616. <handler moduleName="FlowSfsWin" mountPath="/"/>
  4617. </sfs>
  4618. </event>
  4619.  
  4620. <event seq="743" time="2019-02-11 08:43:42.102930 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  4621. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4622. <sfs moduleName="FlowSfsWin" mountPath="/" code="26000" desc="Opening directory succeeded.">
  4623. <parameters path="C:\Share\ProjectA\Eng"/>
  4624. </sfs>
  4625. </event>
  4626.  
  4627. <event seq="744" time="2019-02-11 08:43:42.103026 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4628. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4629. <parameters reply="150 Opening data connection"/>
  4630. </event>
  4631.  
  4632. <event seq="745" time="2019-02-11 08:43:42.118555 -0700" app="BvSshServer 8.24" name="I_FTP_PASV_DISPATCHER_DATA_ACCEPTED" desc="FTP passive data connection accepted.">
  4633. <parameters remoteAddress="8.8.8.8:51475" loc="CA/NA" listenAddress="0.0.0.0:61001" addressRule="AnyIP"/>
  4634. </event>
  4635.  
  4636. <event seq="746" time="2019-02-11 08:43:42.119109 -0700" app="BvSshServer 8.24" name="T_FTP_PASV_DISPATCHER_DATA_DISPATCHED" desc="FTP passive data connection dispatched to the FTP session.">
  4637. <parameters remoteAddress="8.8.8.8:51475" loc="CA/NA" listenAddress="0.0.0.0:61001" sessionId="1020"/>
  4638. </event>
  4639.  
  4640. <event seq="747" time="2019-02-11 08:43:42.119232 -0700" app="BvSshServer 8.24" name="I_FTP_DATA_ACCEPTED" desc="Passive FTP data connection accepted.">
  4641. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4642. <parameters remoteAddress="8.8.8.8:51475" loc="CA/NA" listenAddress="0.0.0.0:61001" operation="List"/>
  4643. </event>
  4644.  
  4645. <event seq="748" time="2019-02-11 08:43:42.134565 -0700" app="BvSshServer 8.24" name="I_FTP_DATA_TLS_NEGOTIATED" desc="TLS algorithms for FTP data connection negotiated.">
  4646. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4647. <parameters remoteAddress="8.8.8.8:51475" loc="CA/NA" operation="List" negNr="1" protocol="TLS 1.2" cipherSuite="TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256"/>
  4648. </event>
  4649.  
  4650. <event seq="749" time="2019-02-11 08:43:42.135381 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  4651. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4652. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  4653. <parameters path="C:\Share\ProjectA\Eng" entriesCount="4" reachedEof="true"/>
  4654. </sfs>
  4655. </event>
  4656.  
  4657. <event seq="750" time="2019-02-11 08:43:42.135422 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  4658. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4659. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  4660. <parameters path="C:\Share\ProjectA\Eng" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  4661. </sfs>
  4662. </event>
  4663.  
  4664. <event seq="751" time="2019-02-11 08:43:42.135855 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  4665. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4666. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  4667. <parameters path="C:\Share\ProjectA\Eng" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  4668. </sfs>
  4669. </event>
  4670.  
  4671. <event seq="752" time="2019-02-11 08:43:42.135887 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  4672. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4673. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  4674. <parameters path="C:\Share\ProjectA\Eng" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  4675. </sfs>
  4676. </event>
  4677.  
  4678. <event seq="753" time="2019-02-11 08:43:42.136412 -0700" app="BvSshServer 8.24" name="I_SFS_LIST_DIRECTORY" desc="Virtual filesystem: list directory.">
  4679. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4680. <sfs moduleName="FlowSfsWin" mountPath="/" code="91000" desc="Listing directory ended.">
  4681. <parameters path="C:\Share\ProjectA\Eng" timeMs="34" entriesCount="4"/>
  4682. </sfs>
  4683. </event>
  4684.  
  4685. <event seq="754" time="2019-02-11 08:43:42.136443 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  4686. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4687. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  4688. <parameters path="C:\Share\ProjectA\Eng" type="Directory"/>
  4689. </sfs>
  4690. </event>
  4691.  
  4692. <event seq="755" time="2019-02-11 08:43:42.152485 -0700" app="BvSshServer 8.24" name="I_FTP_DATA_COMPLETED" desc="FTP data connection completed.">
  4693. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4694. <parameters remoteAddress="8.8.8.8:51475" loc="CA/NA" operation="List"/>
  4695. </event>
  4696.  
  4697. <event seq="756" time="2019-02-11 08:43:42.152585 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4698. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4699. <parameters reply="226 Data connection completed successfully"/>
  4700. </event>
  4701.  
  4702. <event seq="757" time="2019-02-11 08:43:43.799482 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  4703. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4704. <parameters command="CWD Documents"/>
  4705. </event>
  4706.  
  4707. <event seq="758" time="2019-02-11 08:43:43.800019 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  4708. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4709. <sfs moduleName="FlowSfsRoot" code="31904" desc="Paths processed.">
  4710. <parameters pathRaw="/ProjectA/Eng/Documents" path="/ProjectA/Eng/Documents"/>
  4711. <handler moduleName="FlowSfsWin" mountPath="/"/>
  4712. </sfs>
  4713. </event>
  4714.  
  4715. <event seq="759" time="2019-02-11 08:43:43.800061 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  4716. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4717. <sfs moduleName="FlowSfsWin" mountPath="/" code="31000" desc="Querying real path succeeded.">
  4718. <parameters path="C:\Share\ProjectA\Eng\Documents" controlByte="NoCheck"/>
  4719. </sfs>
  4720. </event>
  4721.  
  4722. <event seq="760" time="2019-02-11 08:43:43.800725 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  4723. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4724. <sfs moduleName="FlowSfsRoot" code="26904" desc="Paths processed.">
  4725. <parameters pathRaw="/ProjectA/Eng/Documents" path="/ProjectA/Eng/Documents"/>
  4726. <handler moduleName="FlowSfsWin" mountPath="/"/>
  4727. </sfs>
  4728. </event>
  4729.  
  4730. <event seq="761" time="2019-02-11 08:43:43.800799 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  4731. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4732. <sfs moduleName="FlowSfsWin" mountPath="/" code="26000" desc="Opening directory succeeded.">
  4733. <parameters path="C:\Share\ProjectA\Eng\Documents"/>
  4734. </sfs>
  4735. </event>
  4736.  
  4737. <event seq="762" time="2019-02-11 08:43:43.801238 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  4738. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4739. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  4740. <parameters path="C:\Share\ProjectA\Eng\Documents" type="Directory"/>
  4741. </sfs>
  4742. </event>
  4743.  
  4744. <event seq="763" time="2019-02-11 08:43:43.801314 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4745. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4746. <parameters reply="250 &quot;/ProjectA/Eng/Documents&quot; is current directory"/>
  4747. </event>
  4748.  
  4749. <event seq="764" time="2019-02-11 08:43:43.816177 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  4750. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4751. <parameters command="PWD"/>
  4752. </event>
  4753.  
  4754. <event seq="765" time="2019-02-11 08:43:43.816250 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4755. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4756. <parameters reply="257 &quot;/ProjectA/Eng/Documents&quot; is current directory"/>
  4757. </event>
  4758.  
  4759. <event seq="766" time="2019-02-11 08:43:43.830393 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  4760. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4761. <parameters command="PASV"/>
  4762. </event>
  4763.  
  4764. <event seq="767" time="2019-02-11 08:43:43.830573 -0700" app="BvSshServer 8.24" name="T_FTP_DATA_ACCEPT_STARTED" desc="Passive FTP data connection attempt started.">
  4765. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4766. <parameters listenAddress="0.0.0.0:61001" replyAddress="74.3.185.50:61001"/>
  4767. </event>
  4768.  
  4769. <event seq="768" time="2019-02-11 08:43:43.830641 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4770. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4771. <parameters reply="227 Entering Passive Mode (74,3,185,50,238,73)"/>
  4772. </event>
  4773.  
  4774. <event seq="769" time="2019-02-11 08:43:43.895447 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  4775. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4776. <parameters command="LIST"/>
  4777. </event>
  4778.  
  4779. <event seq="770" time="2019-02-11 08:43:43.896055 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  4780. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4781. <sfs moduleName="FlowSfsRoot" code="26904" desc="Paths processed.">
  4782. <parameters pathRaw="/ProjectA/Eng/Documents" path="/ProjectA/Eng/Documents"/>
  4783. <handler moduleName="FlowSfsWin" mountPath="/"/>
  4784. </sfs>
  4785. </event>
  4786.  
  4787. <event seq="771" time="2019-02-11 08:43:43.896088 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  4788. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4789. <sfs moduleName="FlowSfsWin" mountPath="/" code="26000" desc="Opening directory succeeded.">
  4790. <parameters path="C:\Share\ProjectA\Eng\Documents"/>
  4791. </sfs>
  4792. </event>
  4793.  
  4794. <event seq="772" time="2019-02-11 08:43:43.896203 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4795. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4796. <parameters reply="150 Opening data connection"/>
  4797. </event>
  4798.  
  4799. <event seq="773" time="2019-02-11 08:43:43.911800 -0700" app="BvSshServer 8.24" name="I_FTP_PASV_DISPATCHER_DATA_ACCEPTED" desc="FTP passive data connection accepted.">
  4800. <parameters remoteAddress="8.8.8.8:51476" loc="CA/NA" listenAddress="0.0.0.0:61001" addressRule="AnyIP"/>
  4801. </event>
  4802.  
  4803. <event seq="774" time="2019-02-11 08:43:43.912294 -0700" app="BvSshServer 8.24" name="T_FTP_PASV_DISPATCHER_DATA_DISPATCHED" desc="FTP passive data connection dispatched to the FTP session.">
  4804. <parameters remoteAddress="8.8.8.8:51476" loc="CA/NA" listenAddress="0.0.0.0:61001" sessionId="1020"/>
  4805. </event>
  4806.  
  4807. <event seq="775" time="2019-02-11 08:43:43.912397 -0700" app="BvSshServer 8.24" name="I_FTP_DATA_ACCEPTED" desc="Passive FTP data connection accepted.">
  4808. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4809. <parameters remoteAddress="8.8.8.8:51476" loc="CA/NA" listenAddress="0.0.0.0:61001" operation="List"/>
  4810. </event>
  4811.  
  4812. <event seq="776" time="2019-02-11 08:43:43.928944 -0700" app="BvSshServer 8.24" name="I_FTP_DATA_TLS_NEGOTIATED" desc="TLS algorithms for FTP data connection negotiated.">
  4813. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4814. <parameters remoteAddress="8.8.8.8:51476" loc="CA/NA" operation="List" negNr="1" protocol="TLS 1.2" cipherSuite="TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256"/>
  4815. </event>
  4816.  
  4817. <event seq="777" time="2019-02-11 08:43:43.930089 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  4818. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4819. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  4820. <parameters path="C:\Share\ProjectA\Eng\Documents" entriesCount="7" reachedEof="true"/>
  4821. </sfs>
  4822. </event>
  4823.  
  4824. <event seq="778" time="2019-02-11 08:43:43.930131 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  4825. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4826. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  4827. <parameters path="C:\Share\ProjectA\Eng\Documents" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  4828. </sfs>
  4829. </event>
  4830.  
  4831. <event seq="779" time="2019-02-11 08:43:43.930914 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  4832. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4833. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  4834. <parameters path="C:\Share\ProjectA\Eng\Documents" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  4835. </sfs>
  4836. </event>
  4837.  
  4838. <event seq="780" time="2019-02-11 08:43:43.930945 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  4839. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4840. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  4841. <parameters path="C:\Share\ProjectA\Eng\Documents" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  4842. </sfs>
  4843. </event>
  4844.  
  4845. <event seq="781" time="2019-02-11 08:43:43.931362 -0700" app="BvSshServer 8.24" name="I_SFS_LIST_DIRECTORY" desc="Virtual filesystem: list directory.">
  4846. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4847. <sfs moduleName="FlowSfsWin" mountPath="/" code="91000" desc="Listing directory ended.">
  4848. <parameters path="C:\Share\ProjectA\Eng\Documents" timeMs="36" entriesCount="7"/>
  4849. </sfs>
  4850. </event>
  4851.  
  4852. <event seq="782" time="2019-02-11 08:43:43.931393 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  4853. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4854. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  4855. <parameters path="C:\Share\ProjectA\Eng\Documents" type="Directory"/>
  4856. </sfs>
  4857. </event>
  4858.  
  4859. <event seq="783" time="2019-02-11 08:43:43.948703 -0700" app="BvSshServer 8.24" name="I_FTP_DATA_COMPLETED" desc="FTP data connection completed.">
  4860. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4861. <parameters remoteAddress="8.8.8.8:51476" loc="CA/NA" operation="List"/>
  4862. </event>
  4863.  
  4864. <event seq="784" time="2019-02-11 08:43:43.948806 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4865. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4866. <parameters reply="226 Data connection completed successfully"/>
  4867. </event>
  4868.  
  4869. <event seq="785" time="2019-02-11 08:43:44.695430 -0700" app="BvSshServer 8.24" name="I_CHANNEL_SESSION_CLOSED" desc="Session channel closed.">
  4870. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4871. <channel type="session" id="1"/>
  4872. <parameters bytesReceived="292" bytesSent="79807"/>
  4873. </event>
  4874.  
  4875. <event seq="786" time="2019-02-11 08:43:44.696025 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_PROCESS_COMPLETED" desc="Process completed; terminating job.">
  4876. <channel type="session" id="1"/>
  4877. <parameters processFrom="SessionChannel" exitCode="0"/>
  4878. </event>
  4879.  
  4880. <event seq="787" time="2019-02-11 08:43:44.722434 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  4881. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4882. <parameters command="CWD Bid Spread"/>
  4883. </event>
  4884.  
  4885. <event seq="788" time="2019-02-11 08:43:44.722940 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  4886. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4887. <sfs moduleName="FlowSfsRoot" code="31904" desc="Paths processed.">
  4888. <parameters pathRaw="/ProjectA/Eng/Documents/Bid Spread" path="/ProjectA/Eng/Documents/Bid Spread"/>
  4889. <handler moduleName="FlowSfsWin" mountPath="/"/>
  4890. </sfs>
  4891. </event>
  4892.  
  4893. <event seq="789" time="2019-02-11 08:43:44.722978 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  4894. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4895. <sfs moduleName="FlowSfsWin" mountPath="/" code="31000" desc="Querying real path succeeded.">
  4896. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread" controlByte="NoCheck"/>
  4897. </sfs>
  4898. </event>
  4899.  
  4900. <event seq="790" time="2019-02-11 08:43:44.723704 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  4901. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4902. <sfs moduleName="FlowSfsRoot" code="26904" desc="Paths processed.">
  4903. <parameters pathRaw="/ProjectA/Eng/Documents/Bid Spread" path="/ProjectA/Eng/Documents/Bid Spread"/>
  4904. <handler moduleName="FlowSfsWin" mountPath="/"/>
  4905. </sfs>
  4906. </event>
  4907.  
  4908. <event seq="791" time="2019-02-11 08:43:44.723741 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  4909. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4910. <sfs moduleName="FlowSfsWin" mountPath="/" code="26000" desc="Opening directory succeeded.">
  4911. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread"/>
  4912. </sfs>
  4913. </event>
  4914.  
  4915. <event seq="792" time="2019-02-11 08:43:44.724188 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  4916. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4917. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  4918. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread" type="Directory"/>
  4919. </sfs>
  4920. </event>
  4921.  
  4922. <event seq="793" time="2019-02-11 08:43:44.724251 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4923. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4924. <parameters reply="250 &quot;/ProjectA/Eng/Documents/Bid Spread&quot; is current directory"/>
  4925. </event>
  4926.  
  4927. <event seq="794" time="2019-02-11 08:43:44.738383 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  4928. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4929. <parameters command="PWD"/>
  4930. </event>
  4931.  
  4932. <event seq="795" time="2019-02-11 08:43:44.738424 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4933. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4934. <parameters reply="257 &quot;/ProjectA/Eng/Documents/Bid Spread&quot; is current directory"/>
  4935. </event>
  4936.  
  4937. <event seq="796" time="2019-02-11 08:43:44.753164 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  4938. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4939. <parameters command="PASV"/>
  4940. </event>
  4941.  
  4942. <event seq="797" time="2019-02-11 08:43:44.753309 -0700" app="BvSshServer 8.24" name="T_FTP_DATA_ACCEPT_STARTED" desc="Passive FTP data connection attempt started.">
  4943. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4944. <parameters listenAddress="0.0.0.0:61001" replyAddress="74.3.185.50:61001"/>
  4945. </event>
  4946.  
  4947. <event seq="798" time="2019-02-11 08:43:44.753376 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4948. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4949. <parameters reply="227 Entering Passive Mode (74,3,185,50,238,73)"/>
  4950. </event>
  4951.  
  4952. <event seq="799" time="2019-02-11 08:43:44.767394 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  4953. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4954. <parameters command="LIST"/>
  4955. </event>
  4956.  
  4957. <event seq="800" time="2019-02-11 08:43:44.767965 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  4958. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4959. <sfs moduleName="FlowSfsRoot" code="26904" desc="Paths processed.">
  4960. <parameters pathRaw="/ProjectA/Eng/Documents/Bid Spread" path="/ProjectA/Eng/Documents/Bid Spread"/>
  4961. <handler moduleName="FlowSfsWin" mountPath="/"/>
  4962. </sfs>
  4963. </event>
  4964.  
  4965. <event seq="801" time="2019-02-11 08:43:44.768003 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  4966. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4967. <sfs moduleName="FlowSfsWin" mountPath="/" code="26000" desc="Opening directory succeeded.">
  4968. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread"/>
  4969. </sfs>
  4970. </event>
  4971.  
  4972. <event seq="802" time="2019-02-11 08:43:44.768104 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  4973. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4974. <parameters reply="150 Opening data connection"/>
  4975. </event>
  4976.  
  4977. <event seq="803" time="2019-02-11 08:43:44.783823 -0700" app="BvSshServer 8.24" name="I_FTP_PASV_DISPATCHER_DATA_ACCEPTED" desc="FTP passive data connection accepted.">
  4978. <parameters remoteAddress="8.8.8.8:51477" loc="CA/NA" listenAddress="0.0.0.0:61001" addressRule="AnyIP"/>
  4979. </event>
  4980.  
  4981. <event seq="804" time="2019-02-11 08:43:44.784394 -0700" app="BvSshServer 8.24" name="T_FTP_PASV_DISPATCHER_DATA_DISPATCHED" desc="FTP passive data connection dispatched to the FTP session.">
  4982. <parameters remoteAddress="8.8.8.8:51477" loc="CA/NA" listenAddress="0.0.0.0:61001" sessionId="1020"/>
  4983. </event>
  4984.  
  4985. <event seq="805" time="2019-02-11 08:43:44.784511 -0700" app="BvSshServer 8.24" name="I_FTP_DATA_ACCEPTED" desc="Passive FTP data connection accepted.">
  4986. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4987. <parameters remoteAddress="8.8.8.8:51477" loc="CA/NA" listenAddress="0.0.0.0:61001" operation="List"/>
  4988. </event>
  4989.  
  4990. <event seq="806" time="2019-02-11 08:43:44.799837 -0700" app="BvSshServer 8.24" name="I_FTP_DATA_TLS_NEGOTIATED" desc="TLS algorithms for FTP data connection negotiated.">
  4991. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4992. <parameters remoteAddress="8.8.8.8:51477" loc="CA/NA" operation="List" negNr="1" protocol="TLS 1.2" cipherSuite="TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256"/>
  4993. </event>
  4994.  
  4995. <event seq="807" time="2019-02-11 08:43:44.800694 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  4996. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  4997. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  4998. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread" entriesCount="2" reachedEof="true"/>
  4999. </sfs>
  5000. </event>
  5001.  
  5002. <event seq="808" time="2019-02-11 08:43:44.800730 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  5003. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5004. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  5005. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  5006. </sfs>
  5007. </event>
  5008.  
  5009. <event seq="809" time="2019-02-11 08:43:44.801039 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  5010. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5011. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  5012. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  5013. </sfs>
  5014. </event>
  5015.  
  5016. <event seq="810" time="2019-02-11 08:43:44.801069 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  5017. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5018. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  5019. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  5020. </sfs>
  5021. </event>
  5022.  
  5023. <event seq="811" time="2019-02-11 08:43:44.801562 -0700" app="BvSshServer 8.24" name="I_SFS_LIST_DIRECTORY" desc="Virtual filesystem: list directory.">
  5024. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5025. <sfs moduleName="FlowSfsWin" mountPath="/" code="91000" desc="Listing directory ended.">
  5026. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread" timeMs="34" entriesCount="2"/>
  5027. </sfs>
  5028. </event>
  5029.  
  5030. <event seq="812" time="2019-02-11 08:43:44.801594 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  5031. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5032. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  5033. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread" type="Directory"/>
  5034. </sfs>
  5035. </event>
  5036.  
  5037. <event seq="813" time="2019-02-11 08:43:44.817958 -0700" app="BvSshServer 8.24" name="I_FTP_DATA_COMPLETED" desc="FTP data connection completed.">
  5038. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5039. <parameters remoteAddress="8.8.8.8:51477" loc="CA/NA" operation="List"/>
  5040. </event>
  5041.  
  5042. <event seq="814" time="2019-02-11 08:43:44.818174 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  5043. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5044. <parameters reply="226 Data connection completed successfully"/>
  5045. </event>
  5046.  
  5047. <event seq="815" time="2019-02-11 08:43:44.846257 -0700" app="BvSshServer 8.24" name="I_SESSION_DISCONNECTED_NORMALLY" desc="Session disconnected normally.">
  5048. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5049. <parameters disconnectReason="Ssh" socketBytesReceived="4546" socketBytesSent="89393" payloadBytesReceived="2187" payloadBytesSent="83197" channelBytesReceived="292" channelBytesSent="79807"/>
  5050. <error type="Flow" component="SshManager/packetDecoder" class="LocalSshDisconn" code="ByApplication" description="FlowSshPacketDecoder: unresponsiveness timeout"/>
  5051. <sessions ssh="0" sshAuth="0" ftp="1" ftpAuth="1"/>
  5052. </event>
  5053.  
  5054. <event seq="816" time="2019-02-11 08:43:44.846317 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_NO_PROCESS_HANDLE" desc="No process handle supplied.">
  5055. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5056. <parameters processFrom="OnLogonCommand"/>
  5057. </event>
  5058.  
  5059. <event seq="817" time="2019-02-11 08:43:44.846334 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_NO_PROCESS_HANDLE" desc="No process handle supplied.">
  5060. <session id="1019" service="SSH" remoteAddress="8.8.8.8:51419" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5061. <parameters processFrom="OnLogoffCommand"/>
  5062. </event>
  5063.  
  5064. <event seq="818" time="2019-02-11 08:43:58.508789 -0700" app="BvSshServer 8.24" name="I_CONNECT_ACCEPTED" desc="Connection accepted.">
  5065. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA"/>
  5066. <location continent="North America" country="Canada"/>
  5067. <parameters addressRule="AnyIP" listenAddress="192.168.0.2:21"/>
  5068. <sessions ssh="0" sshAuth="0" ftp="2" ftpAuth="1"/>
  5069. </event>
  5070.  
  5071. <event seq="819" time="2019-02-11 08:43:58.509144 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  5072. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA"/>
  5073. <parameters reply="220 Bitvise SSH Server 8.24"/>
  5074. </event>
  5075.  
  5076. <event seq="820" time="2019-02-11 08:43:58.524377 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  5077. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA"/>
  5078. <parameters command="AUTH TLS"/>
  5079. </event>
  5080.  
  5081. <event seq="821" time="2019-02-11 08:43:58.524418 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  5082. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA"/>
  5083. <parameters reply="234 Security mechanism set to TLS"/>
  5084. </event>
  5085.  
  5086. <event seq="822" time="2019-02-11 08:43:58.606682 -0700" app="BvSshServer 8.24" name="I_FTP_CONTROL_TLS_NEGOTIATED" desc="TLS algorithms for FTP control connection negotiated.">
  5087. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA"/>
  5088. <parameters negNr="1" protocol="TLS 1.2" cipherSuite="TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256"/>
  5089. </event>
  5090.  
  5091. <event seq="823" time="2019-02-11 08:43:58.623388 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  5092. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA"/>
  5093. <parameters command="USER testuser"/>
  5094. </event>
  5095.  
  5096. <event seq="824" time="2019-02-11 08:43:58.623447 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  5097. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA"/>
  5098. <parameters reply="331 Need password"/>
  5099. </event>
  5100.  
  5101. <event seq="825" time="2019-02-11 08:43:58.644380 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  5102. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA"/>
  5103. <parameters command="PASS ***"/>
  5104. </event>
  5105.  
  5106. <event seq="826" time="2019-02-11 08:43:58.644422 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_ATTEMPT_STARTED" desc="User authentication attempt started.">
  5107. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA"/>
  5108. <authentication attemptNr="1" userName="testuser" method="password"/>
  5109. </event>
  5110.  
  5111. <event seq="827" time="2019-02-11 08:43:58.673647 -0700" app="BvSshServer 8.24" name="T_LOGON_PROCEDURE_TIMING" desc="Logon procedure timing.">
  5112. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA"/>
  5113. <parameters procedure="LogonUser()" timerMs="2"/>
  5114. </event>
  5115.  
  5116. <event seq="828" time="2019-02-11 08:43:58.673690 -0700" app="BvSshServer 8.24" name="T_LOGON_TOKEN_ELEVATION_CHANGE_FAILED" desc="Could not change or obtain user token elevation state.">
  5117. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA"/>
  5118. <parameters desiredElevation="Yes" failureReason="LinkedTokenNotAvailable"/>
  5119. <help message="Elevation state cannot be changed for sessions with the 'network' logon type."/>
  5120. </event>
  5121.  
  5122. <event seq="829" time="2019-02-11 08:43:58.685883 -0700" app="BvSshServer 8.24" name="T_LOGON_PROCEDURE_TIMING" desc="Logon procedure timing.">
  5123. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA"/>
  5124. <parameters procedure="NetUserGetInfo()" timerMs="12"/>
  5125. </event>
  5126.  
  5127. <event seq="830" time="2019-02-11 08:43:58.686470 -0700" app="BvSshServer 8.24" name="I_LOGON_AUTH_SUCCEEDED" desc="User authentication succeeded.">
  5128. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5129. <authentication attemptNr="1" serialize="completion" userName="testuser" method="password"/>
  5130. <parameters accountSettings="testuser" groupSettings="Virtual Users" tokenType="LogonUser" tokenLogonType="Network" tokenElevation="Restricted"/>
  5131. </event>
  5132.  
  5133. <event seq="831" time="2019-02-11 08:43:58.686582 -0700" app="BvSshServer 8.24" name="T_LOGON_HOME_DIRECTORY_RETRIEVE_ERROR" desc="Error retrieving home directory.">
  5134. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5135. <error type="WinApi" operation="GetUserProfileDirectory()" code="2" message="The system cannot find the file specified."/>
  5136. </event>
  5137.  
  5138. <event seq="832" time="2019-02-11 08:43:58.687476 -0700" app="BvSshServer 8.24" name="T_LOGON_AUTH_ATTEMPT_ENDED" desc="User authentication attempt ended.">
  5139. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5140. <authentication attemptNr="1" serialize="completion" userName="testuser" method="password"/>
  5141. </event>
  5142.  
  5143. <event seq="833" time="2019-02-11 08:43:58.687518 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  5144. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5145. <parameters reply="230 User logged in"/>
  5146. </event>
  5147.  
  5148. <event seq="834" time="2019-02-11 08:43:58.692414 -0700" app="BvSshServer 8.24" name="T_SUBSYS_EXECUTED" desc="SSH server subsystem executed.">
  5149. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5150. <parameters exeFile="SfsServer.exe"/>
  5151. </event>
  5152.  
  5153. <event seq="835" time="2019-02-11 08:43:58.710233 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  5154. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5155. <sfs moduleName="FlowSfsRoot" code="11901" desc="Initializing module with the following settings.">
  5156. <parameters
  5157. settings="Root
  5158. HomePath=/
  5159. CreateHome=No
  5160. ShowRelative=Yes
  5161. DelayInit=Yes
  5162. Provider=FlowSfsWin
  5163. MountPath=/
  5164. MountMode=List,ReadExist,WriteExist,ReadWriteDeleteNew,CreateDir,CreateLink
  5165. RootPath=C:\Share
  5166. CreateRoot=No
  5167. MaxPathLength=3000
  5168. DelayInit=Yes
  5169. ShowEmptyDir=IfNoAccess
  5170. FileShareBeh=Default
  5171. FileShare=Read,Write
  5172. OwnerGroup=IfUnknown-Default
  5173. Acl=IfUnknownAce-DefaultAcl"/>
  5174. </sfs>
  5175. </event>
  5176.  
  5177. <event seq="836" time="2019-02-11 08:43:58.710280 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  5178. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5179. <sfs moduleName="FlowSfsRoot" code="11000" desc="Initializing module succeeded."/>
  5180. </event>
  5181.  
  5182. <event seq="837" time="2019-02-11 08:43:58.710295 -0700" app="BvSshServer 8.24" name="I_SFS_QUERY_HOME_DIRECTORY" desc="Virtual filesystem: query home directory.">
  5183. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5184. <sfs moduleName="FlowSfsRoot" code="40000" desc="Querying home directory succeeded.">
  5185. <parameters homePath="/"/>
  5186. </sfs>
  5187. </event>
  5188.  
  5189. <event seq="838" time="2019-02-11 08:43:58.710367 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  5190. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5191. <parameters command="OPTS UTF8 ON"/>
  5192. </event>
  5193.  
  5194. <event seq="839" time="2019-02-11 08:43:58.710395 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  5195. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5196. <parameters reply="202 The UTF8 option is already enabled"/>
  5197. </event>
  5198.  
  5199. <event seq="840" time="2019-02-11 08:43:58.727361 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  5200. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5201. <parameters command="PBSZ 0"/>
  5202. </event>
  5203.  
  5204. <event seq="841" time="2019-02-11 08:43:58.727387 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  5205. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5206. <parameters reply="200 PBSZ=0"/>
  5207. </event>
  5208.  
  5209. <event seq="842" time="2019-02-11 08:43:58.744356 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  5210. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5211. <parameters command="PROT P"/>
  5212. </event>
  5213.  
  5214. <event seq="843" time="2019-02-11 08:43:58.744381 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  5215. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5216. <parameters reply="200 Data protection level set to Private"/>
  5217. </event>
  5218.  
  5219. <event seq="844" time="2019-02-11 08:43:58.766355 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  5220. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5221. <parameters command="CWD /ProjectA/Eng/Documents/Bid Spread"/>
  5222. </event>
  5223.  
  5224. <event seq="845" time="2019-02-11 08:43:58.767289 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  5225. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5226. <sfs moduleName="FlowSfsRoot" code="31904" desc="Paths processed.">
  5227. <parameters pathRaw="/ProjectA/Eng/Documents/Bid Spread" path="/ProjectA/Eng/Documents/Bid Spread"/>
  5228. <handler moduleName="FlowSfsWin" mountPath="/"/>
  5229. </sfs>
  5230. </event>
  5231.  
  5232. <event seq="846" time="2019-02-11 08:43:58.767322 -0700" app="BvSshServer 8.24" name="T_SFS_INITIALIZE" desc="Virtual filesystem initialization.">
  5233. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5234. <sfs moduleName="FlowSfsWin" mountPath="/" code="11000" desc="Initializing module succeeded."/>
  5235. </event>
  5236.  
  5237. <event seq="847" time="2019-02-11 08:43:58.767391 -0700" app="BvSshServer 8.24" name="T_SFS_QUERY_REAL_PATH" desc="Virtual filesystem: query real path.">
  5238. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5239. <sfs moduleName="FlowSfsWin" mountPath="/" code="31000" desc="Querying real path succeeded.">
  5240. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread" controlByte="NoCheck"/>
  5241. </sfs>
  5242. </event>
  5243.  
  5244. <event seq="848" time="2019-02-11 08:43:58.767956 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  5245. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5246. <sfs moduleName="FlowSfsRoot" code="26904" desc="Paths processed.">
  5247. <parameters pathRaw="/ProjectA/Eng/Documents/Bid Spread" path="/ProjectA/Eng/Documents/Bid Spread"/>
  5248. <handler moduleName="FlowSfsWin" mountPath="/"/>
  5249. </sfs>
  5250. </event>
  5251.  
  5252. <event seq="849" time="2019-02-11 08:43:58.768022 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  5253. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5254. <sfs moduleName="FlowSfsWin" mountPath="/" code="26000" desc="Opening directory succeeded.">
  5255. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread"/>
  5256. </sfs>
  5257. </event>
  5258.  
  5259. <event seq="850" time="2019-02-11 08:43:58.768473 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  5260. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5261. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  5262. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread" type="Directory"/>
  5263. </sfs>
  5264. </event>
  5265.  
  5266. <event seq="851" time="2019-02-11 08:43:58.768531 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  5267. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5268. <parameters reply="250 &quot;/ProjectA/Eng/Documents/Bid Spread&quot; is current directory"/>
  5269. </event>
  5270.  
  5271. <event seq="852" time="2019-02-11 08:43:58.783343 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  5272. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5273. <parameters command="PWD"/>
  5274. </event>
  5275.  
  5276. <event seq="853" time="2019-02-11 08:43:58.783373 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  5277. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5278. <parameters reply="257 &quot;/ProjectA/Eng/Documents/Bid Spread&quot; is current directory"/>
  5279. </event>
  5280.  
  5281. <event seq="854" time="2019-02-11 08:43:58.798322 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  5282. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5283. <parameters command="TYPE I"/>
  5284. </event>
  5285.  
  5286. <event seq="855" time="2019-02-11 08:43:58.798349 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  5287. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5288. <parameters reply="200 Representation type set to Image"/>
  5289. </event>
  5290.  
  5291. <event seq="856" time="2019-02-11 08:43:58.813382 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  5292. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5293. <parameters command="PASV"/>
  5294. </event>
  5295.  
  5296. <event seq="857" time="2019-02-11 08:43:58.813523 -0700" app="BvSshServer 8.24" name="T_FTP_DATA_ACCEPT_STARTED" desc="Passive FTP data connection attempt started.">
  5297. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5298. <parameters listenAddress="0.0.0.0:61001" replyAddress="74.3.185.50:61001"/>
  5299. </event>
  5300.  
  5301. <event seq="858" time="2019-02-11 08:43:58.813590 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  5302. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5303. <parameters reply="227 Entering Passive Mode (74,3,185,50,238,73)"/>
  5304. </event>
  5305.  
  5306. <event seq="859" time="2019-02-11 08:43:58.828366 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  5307. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5308. <parameters command="STOR Office 365.pdf"/>
  5309. </event>
  5310.  
  5311. <event seq="860" time="2019-02-11 08:43:58.830143 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_FILE" desc="Virtual filesystem: open file.">
  5312. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5313. <sfs moduleName="FlowSfsRoot" code="20904" desc="Paths processed.">
  5314. <parameters pathRaw="/ProjectA/Eng/Documents/Bid Spread/Office 365.pdf" path="/ProjectA/Eng/Documents/Bid Spread/Office 365.pdf"/>
  5315. <handler moduleName="FlowSfsWin" mountPath="/"/>
  5316. </sfs>
  5317. </event>
  5318.  
  5319. <event seq="861" time="2019-02-11 08:43:58.830179 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_FILE" desc="Virtual filesystem: open file.">
  5320. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5321. <sfs moduleName="FlowSfsWin" mountPath="/" code="20000" desc="Opening file succeeded.">
  5322. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread\Office 365.pdf" flags="0x301" desiredAccess="0x2" createdNewFile="true" partialFailure="false"/>
  5323. </sfs>
  5324. </event>
  5325.  
  5326. <event seq="862" time="2019-02-11 08:43:58.830273 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  5327. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5328. <parameters reply="150 Opening data connection"/>
  5329. </event>
  5330.  
  5331. <event seq="863" time="2019-02-11 08:43:58.844496 -0700" app="BvSshServer 8.24" name="I_FTP_PASV_DISPATCHER_DATA_ACCEPTED" desc="FTP passive data connection accepted.">
  5332. <parameters remoteAddress="8.8.8.8:51485" loc="CA/NA" listenAddress="0.0.0.0:61001" addressRule="AnyIP"/>
  5333. </event>
  5334.  
  5335. <event seq="864" time="2019-02-11 08:43:58.845054 -0700" app="BvSshServer 8.24" name="T_FTP_PASV_DISPATCHER_DATA_DISPATCHED" desc="FTP passive data connection dispatched to the FTP session.">
  5336. <parameters remoteAddress="8.8.8.8:51485" loc="CA/NA" listenAddress="0.0.0.0:61001" sessionId="1021"/>
  5337. </event>
  5338.  
  5339. <event seq="865" time="2019-02-11 08:43:58.845173 -0700" app="BvSshServer 8.24" name="I_FTP_DATA_ACCEPTED" desc="Passive FTP data connection accepted.">
  5340. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5341. <parameters remoteAddress="8.8.8.8:51485" loc="CA/NA" listenAddress="0.0.0.0:61001" operation="Stor"/>
  5342. </event>
  5343.  
  5344. <event seq="866" time="2019-02-11 08:43:58.860636 -0700" app="BvSshServer 8.24" name="I_FTP_DATA_TLS_NEGOTIATED" desc="TLS algorithms for FTP data connection negotiated.">
  5345. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5346. <parameters remoteAddress="8.8.8.8:51485" loc="CA/NA" operation="Stor" negNr="1" protocol="TLS 1.2" cipherSuite="TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256"/>
  5347. </event>
  5348.  
  5349. <event seq="867" time="2019-02-11 08:43:58.876737 -0700" app="BvSshServer 8.24" name="T_SFS_WRITE_FILE" desc="Virtual filesystem: write file.">
  5350. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5351. <sfs moduleName="FlowSfsWin" mountPath="/" code="23000" desc="Writing file succeeded.">
  5352. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread\Office 365.pdf" offset="0" length="16384"/>
  5353. </sfs>
  5354. </event>
  5355.  
  5356. <event seq="868" time="2019-02-11 08:43:58.877201 -0700" app="BvSshServer 8.24" name="T_SFS_WRITE_FILE" desc="Virtual filesystem: write file.">
  5357. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5358. <sfs moduleName="FlowSfsWin" mountPath="/" code="23000" desc="Writing file succeeded.">
  5359. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread\Office 365.pdf" offset="16384" length="16384"/>
  5360. </sfs>
  5361. </event>
  5362.  
  5363. <event seq="869" time="2019-02-11 08:43:58.890274 -0700" app="BvSshServer 8.24" name="T_SFS_WRITE_FILE" desc="Virtual filesystem: write file.">
  5364. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5365. <sfs moduleName="FlowSfsWin" mountPath="/" code="23000" desc="Writing file succeeded.">
  5366. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread\Office 365.pdf" offset="32768" length="16384"/>
  5367. </sfs>
  5368. </event>
  5369.  
  5370. <event seq="870" time="2019-02-11 08:43:58.891626 -0700" app="BvSshServer 8.24" name="T_SFS_WRITE_FILE" desc="Virtual filesystem: write file.">
  5371. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5372. <sfs moduleName="FlowSfsWin" mountPath="/" code="23000" desc="Writing file succeeded.">
  5373. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread\Office 365.pdf" offset="49152" length="16384"/>
  5374. </sfs>
  5375. </event>
  5376.  
  5377. <event seq="871" time="2019-02-11 08:43:58.892776 -0700" app="BvSshServer 8.24" name="T_SFS_WRITE_FILE" desc="Virtual filesystem: write file.">
  5378. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5379. <sfs moduleName="FlowSfsWin" mountPath="/" code="23000" desc="Writing file succeeded.">
  5380. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread\Office 365.pdf" offset="65536" length="16384"/>
  5381. </sfs>
  5382. </event>
  5383.  
  5384. <event seq="872" time="2019-02-11 08:43:58.918159 -0700" app="BvSshServer 8.24" name="T_FTP_DATA_EOF_RECEIVED" desc="Received EOF on FTP data connection.">
  5385. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5386. <parameters remoteAddress="8.8.8.8:51485" loc="CA/NA" operation="Stor" eofType="TlsShutdown"/>
  5387. </event>
  5388.  
  5389. <event seq="873" time="2019-02-11 08:43:58.919478 -0700" app="BvSshServer 8.24" name="T_SFS_WRITE_FILE" desc="Virtual filesystem: write file.">
  5390. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5391. <sfs moduleName="FlowSfsWin" mountPath="/" code="23000" desc="Writing file succeeded.">
  5392. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread\Office 365.pdf" offset="81920" length="32768"/>
  5393. </sfs>
  5394. </event>
  5395.  
  5396. <event seq="874" time="2019-02-11 08:43:58.919587 -0700" app="BvSshServer 8.24" name="T_SFS_WRITE_FILE" desc="Virtual filesystem: write file.">
  5397. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5398. <sfs moduleName="FlowSfsWin" mountPath="/" code="23000" desc="Writing file succeeded.">
  5399. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread\Office 365.pdf" offset="114688" length="7351"/>
  5400. </sfs>
  5401. </event>
  5402.  
  5403. <event seq="875" time="2019-02-11 08:43:58.919610 -0700" app="BvSshServer 8.24" name="I_SFS_TRANSFER_FILE" desc="Virtual filesystem: transfer file.">
  5404. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5405. <sfs moduleName="FlowSfsWin" mountPath="/" code="90000" desc="Transferring file ended.">
  5406. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread\Office 365.pdf" timeMs="90" bytesRead="0" bytesWritten="122039" readRangeOffset="0" readRangeLength="0" writeRangeOffset="0" writeRangeLength="122039" createdNewFile="true" resizedFile="false" startSize="0" finalSize="122039" endedBy="Client" download="none" upload="full"/>
  5407. <help message="File transfer ended by client."/>
  5408. </sfs>
  5409. </event>
  5410.  
  5411. <event seq="876" time="2019-02-11 08:43:58.919687 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  5412. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5413. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  5414. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread\Office 365.pdf" type="File"/>
  5415. </sfs>
  5416. </event>
  5417.  
  5418. <event seq="877" time="2019-02-11 08:43:58.920728 -0700" app="BvSshServer 8.24" name="I_FTP_DATA_COMPLETED" desc="FTP data connection completed.">
  5419. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5420. <parameters remoteAddress="8.8.8.8:51485" loc="CA/NA" operation="Stor"/>
  5421. </event>
  5422.  
  5423. <event seq="878" time="2019-02-11 08:43:58.920832 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  5424. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5425. <parameters reply="226 Data connection completed successfully"/>
  5426. </event>
  5427.  
  5428. <event seq="879" time="2019-02-11 08:43:58.942356 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  5429. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5430. <parameters command="PASV"/>
  5431. </event>
  5432.  
  5433. <event seq="880" time="2019-02-11 08:43:58.942492 -0700" app="BvSshServer 8.24" name="T_FTP_DATA_ACCEPT_STARTED" desc="Passive FTP data connection attempt started.">
  5434. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5435. <parameters listenAddress="0.0.0.0:61001" replyAddress="74.3.185.50:61001"/>
  5436. </event>
  5437.  
  5438. <event seq="881" time="2019-02-11 08:43:58.942557 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  5439. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5440. <parameters reply="227 Entering Passive Mode (74,3,185,50,238,73)"/>
  5441. </event>
  5442.  
  5443. <event seq="882" time="2019-02-11 08:43:58.956374 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  5444. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5445. <parameters command="LIST"/>
  5446. </event>
  5447.  
  5448. <event seq="883" time="2019-02-11 08:43:58.956949 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  5449. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5450. <sfs moduleName="FlowSfsRoot" code="26904" desc="Paths processed.">
  5451. <parameters pathRaw="/ProjectA/Eng/Documents/Bid Spread" path="/ProjectA/Eng/Documents/Bid Spread"/>
  5452. <handler moduleName="FlowSfsWin" mountPath="/"/>
  5453. </sfs>
  5454. </event>
  5455.  
  5456. <event seq="884" time="2019-02-11 08:43:58.956987 -0700" app="BvSshServer 8.24" name="T_SFS_OPEN_DIRECTORY" desc="Virtual filesystem: open directory.">
  5457. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5458. <sfs moduleName="FlowSfsWin" mountPath="/" code="26000" desc="Opening directory succeeded.">
  5459. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread"/>
  5460. </sfs>
  5461. </event>
  5462.  
  5463. <event seq="885" time="2019-02-11 08:43:58.957080 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  5464. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5465. <parameters reply="150 Opening data connection"/>
  5466. </event>
  5467.  
  5468. <event seq="886" time="2019-02-11 08:43:58.972520 -0700" app="BvSshServer 8.24" name="I_FTP_PASV_DISPATCHER_DATA_ACCEPTED" desc="FTP passive data connection accepted.">
  5469. <parameters remoteAddress="8.8.8.8:51486" loc="CA/NA" listenAddress="0.0.0.0:61001" addressRule="AnyIP"/>
  5470. </event>
  5471.  
  5472. <event seq="887" time="2019-02-11 08:43:58.973061 -0700" app="BvSshServer 8.24" name="T_FTP_PASV_DISPATCHER_DATA_DISPATCHED" desc="FTP passive data connection dispatched to the FTP session.">
  5473. <parameters remoteAddress="8.8.8.8:51486" loc="CA/NA" listenAddress="0.0.0.0:61001" sessionId="1021"/>
  5474. </event>
  5475.  
  5476. <event seq="888" time="2019-02-11 08:43:58.973161 -0700" app="BvSshServer 8.24" name="I_FTP_DATA_ACCEPTED" desc="Passive FTP data connection accepted.">
  5477. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5478. <parameters remoteAddress="8.8.8.8:51486" loc="CA/NA" listenAddress="0.0.0.0:61001" operation="List"/>
  5479. </event>
  5480.  
  5481. <event seq="889" time="2019-02-11 08:43:59.035234 -0700" app="BvSshServer 8.24" name="I_FTP_DATA_TLS_NEGOTIATED" desc="TLS algorithms for FTP data connection negotiated.">
  5482. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5483. <parameters remoteAddress="8.8.8.8:51486" loc="CA/NA" operation="List" negNr="1" protocol="TLS 1.2" cipherSuite="TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256"/>
  5484. </event>
  5485.  
  5486. <event seq="890" time="2019-02-11 08:43:59.036343 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  5487. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5488. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  5489. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread" entriesCount="3" reachedEof="true"/>
  5490. </sfs>
  5491. </event>
  5492.  
  5493. <event seq="891" time="2019-02-11 08:43:59.036375 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  5494. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5495. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  5496. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  5497. </sfs>
  5498. </event>
  5499.  
  5500. <event seq="892" time="2019-02-11 08:43:59.036799 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  5501. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5502. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  5503. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  5504. </sfs>
  5505. </event>
  5506.  
  5507. <event seq="893" time="2019-02-11 08:43:59.036826 -0700" app="BvSshServer 8.24" name="T_SFS_READ_DIRECTORY" desc="Virtual filesystem: read directory.">
  5508. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5509. <sfs moduleName="FlowSfsWin" mountPath="/" code="27000" desc="Reading directory succeeded.">
  5510. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread" entriesCount="0" reachedEof="true" statusCode="Eof"/>
  5511. </sfs>
  5512. </event>
  5513.  
  5514. <event seq="894" time="2019-02-11 08:43:59.037406 -0700" app="BvSshServer 8.24" name="I_SFS_LIST_DIRECTORY" desc="Virtual filesystem: list directory.">
  5515. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5516. <sfs moduleName="FlowSfsWin" mountPath="/" code="91000" desc="Listing directory ended.">
  5517. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread" timeMs="80" entriesCount="3"/>
  5518. </sfs>
  5519. </event>
  5520.  
  5521. <event seq="895" time="2019-02-11 08:43:59.037434 -0700" app="BvSshServer 8.24" name="T_SFS_CLOSE_FILE" desc="Virtual filesystem: close file.">
  5522. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5523. <sfs moduleName="FlowSfsWin" mountPath="/" code="21000" desc="Closing file succeeded.">
  5524. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread" type="Directory"/>
  5525. </sfs>
  5526. </event>
  5527.  
  5528. <event seq="896" time="2019-02-11 08:43:59.058520 -0700" app="BvSshServer 8.24" name="I_FTP_DATA_COMPLETED" desc="FTP data connection completed.">
  5529. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5530. <parameters remoteAddress="8.8.8.8:51486" loc="CA/NA" operation="List"/>
  5531. </event>
  5532.  
  5533. <event seq="897" time="2019-02-11 08:43:59.058910 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  5534. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5535. <parameters reply="226 Data connection completed successfully"/>
  5536. </event>
  5537.  
  5538. <event seq="898" time="2019-02-11 08:43:59.073379 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  5539. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5540. <parameters command="MDTM Office 365.pdf"/>
  5541. </event>
  5542.  
  5543. <event seq="899" time="2019-02-11 08:43:59.074797 -0700" app="BvSshServer 8.24" name="T_SFS_GET_FILE_STATUS" desc="Virtual filesystem: get file status.">
  5544. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5545. <sfs moduleName="FlowSfsRoot" code="24904" desc="Paths processed.">
  5546. <parameters pathRaw="/ProjectA/Eng/Documents/Bid Spread/Office 365.pdf" path="/ProjectA/Eng/Documents/Bid Spread/Office 365.pdf"/>
  5547. <handler moduleName="FlowSfsWin" mountPath="/"/>
  5548. </sfs>
  5549. </event>
  5550.  
  5551. <event seq="900" time="2019-02-11 08:43:59.074837 -0700" app="BvSshServer 8.24" name="I_SFS_GET_FILE_STATUS" desc="Virtual filesystem: get file status.">
  5552. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5553. <sfs moduleName="FlowSfsWin" mountPath="/" code="24000" desc="Getting file status succeeded.">
  5554. <parameters path="C:\Share\ProjectA\Eng\Documents\Bid Spread\Office 365.pdf" flags="0x20" partialFailure="false"/>
  5555. </sfs>
  5556. </event>
  5557.  
  5558. <event seq="901" time="2019-02-11 08:43:59.075171 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  5559. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5560. <parameters reply="213 20190211154358"/>
  5561. </event>
  5562.  
  5563. <event seq="902" time="2019-02-11 08:44:03.907399 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_COMMAND_RECEIVED" desc="FTP command received over FTP control connection.">
  5564. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5565. <parameters command="DELE Office 365.pdf"/>
  5566. </event>
  5567.  
  5568. <event seq="903" time="2019-02-11 08:44:03.907973 -0700" app="BvSshServer 8.24" name="T_SFS_REMOVE_FILE" desc="Virtual filesystem: remove file.">
  5569. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5570. <sfs moduleName="FlowSfsRoot" code="28904" desc="Paths processed.">
  5571. <parameters pathRaw="/ProjectA/Eng/Documents/Bid Spread/Office 365.pdf" path="/ProjectA/Eng/Documents/Bid Spread/Office 365.pdf"/>
  5572. <handler moduleName="FlowSfsWin" mountPath="/"/>
  5573. </sfs>
  5574. </event>
  5575.  
  5576. <event seq="904" time="2019-02-11 08:44:03.908015 -0700" app="BvSshServer 8.24" name="I_SFS_REMOVE_FILE" desc="Virtual filesystem: remove file.">
  5577. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5578. <sfs moduleName="FlowSfsRoot" code="28200" desc="Removing file failed.">
  5579. <parameters path="/ProjectA/Eng/Documents/Bid Spread/Office 365.pdf" statusCode="PermissionDenied"/>
  5580. <handler moduleName="FlowSfsWin" mountPath="/"/>
  5581. <error type="Exception" message="The handler lacks delete existing permission."/>
  5582. </sfs>
  5583. </event>
  5584.  
  5585. <event seq="905" time="2019-02-11 08:44:03.908588 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_REPLY_SENT" desc="FTP reply sent over FTP control connection.">
  5586. <session id="1020" service="FTP" remoteAddress="8.8.8.8:51420" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5587. <parameters reply="553 Failed to delete file; SFS Remove failed with PermissionDenied: Permission denied."/>
  5588. </event>
  5589.  
  5590. <event seq="906" time="2019-02-11 08:44:58.929296 -0700" app="BvSshServer 8.24" name="T_FTP_CONTROL_EOF_RECEIVED" desc="Received EOF on FTP control connection.">
  5591. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5592. <parameters eofType="SocketEof"/>
  5593. </event>
  5594.  
  5595. <event seq="907" time="2019-02-11 08:44:58.934408 -0700" app="BvSshServer 8.24" name="I_SESSION_DISCONNECTED_NORMALLY" desc="Session disconnected normally.">
  5596. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5597. <parameters disconnectReason="EndOfSession" socketBytesReceived="125641" socketBytesSent="3441" payloadBytesReceived="122252" payloadBytesSent="793"/>
  5598. <sessions ssh="0" sshAuth="0" ftp="1" ftpAuth="1"/>
  5599. <help message="The session has ended normally."/>
  5600. </event>
  5601.  
  5602. <event seq="908" time="2019-02-11 08:44:58.934461 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_NO_PROCESS_HANDLE" desc="No process handle supplied.">
  5603. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5604. <parameters processFrom="OnLogonCommand"/>
  5605. </event>
  5606.  
  5607. <event seq="909" time="2019-02-11 08:44:58.934477 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_NO_PROCESS_HANDLE" desc="No process handle supplied.">
  5608. <session id="1021" service="FTP" remoteAddress="8.8.8.8:51484" loc="CA/NA" virtualAccount="testuser" windowsAccount="FTPTEST\BvSsh_VirtualUsers"/>
  5609. <parameters processFrom="OnLogoffCommand"/>
  5610. </event>
  5611.  
  5612. <event seq="910" time="2019-02-11 08:44:58.935136 -0700" app="BvSshServer 8.24" name="T_PROCESS_TERMINATOR_PROCESS_COMPLETED" desc="Process completed; terminating job.">
  5613. <parameters processFrom="FtpSession" exitCode="0"/>
  5614. </event>
  5615. </log>
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!