How to: capture user log in activity using Titan SFTP Events

Question:
How can I capture and monitor user login activity (successful and failed login attempts) in Titan SFTP using the built-in Events feature?

Answer:
Titan SFTP provides an Events and Logging framework that allows administrators to track user authentication activity, including successful logins, failed login attempts, connection source (IP address), timestamp, and protocol used (SFTP/FTPS/HTTPS). By enabling and configuring the appropriate authentication-related events, login activity can be recorded for auditing, troubleshooting, and security monitoring purposes. These events can be written to log files, Windows Event Viewer, or forwarded to external systems depending on the configuration.

• Titan SFTP Server installed and running
• Administrator access to the Titan SFTP

Steps:

1. Login Titan Admin Web UI
2. Navigate to Domain > Server > Events
3. Click Add New to create new Event
4. Select Events and click Add Event
   
5. Expand User Events and select “User login Attempt Successful”
6. Click Okay
   
7. Select Action and click Add Action
   
8. Select Write to custom log or file
9. Add Log text

For example:

%SYSDATETIME%: New Login from %PROTOCOL% - %CXN.CLIENTIP% - %USR.USERNAME% - SESSIONID: %SESSIONID%

10. Click Browse and Browse the logfile where you want to save the logs
11. Click Okay
    
12. Click Next and Add Event name and Description
13. Click Next 
    
14. Then Click Finish.
    

After completing the steps, try to login your users and see if the custom log captures the correct information.

For more variable, please see How To: Get the list of Variables