We used both custom analysis of apache logs and Visitors tool (http://www.hping.org/visitors/) on combined access_log and ssl_access_log. vsftpd log was analyzed ...