---
title: "ftp.crushftp"
canonical: "https://docs.devo.com/space/latest/367263887/ftp.crushftp"
format: markdown
---
[ [Introduction](https://devodocs.atlassian.net/wiki/spaces/latest/pages/356581394/mail.abnormalsecurity#Introduction) ] [ [Valid tags and data tables ](https://devodocs.atlassian.net/wiki/spaces/latest/pages/356581394/mail.abnormalsecurity#Valid-tags-and-data-tables) ] [ [Table structure](https://devodocs.atlassian.net/wiki/spaces/latest/pages/356581394/mail.abnormalsecurity#Table-structure) ]

## Introduction

The tags beginning with `ftp.crushftp` identify events generated by [CrushFTP](https://www.crushftp.com/index.html).

## Valid tags and data tables 

The full tag must have four levels. The first two are fixed as** **`ftp.crushftp`. The third level identifies the type of events sent. The fourth indicates the event subtype.

These are the valid tags and corresponding data tables that will receive the parsers' data:

| **Product / Service** | **Tags** | **Data tables** |
| --- | --- | --- |
| CrushFTP | `ftp.crushftp.event` | `ftp.crushftp.event` |

For more information, read more [about Devo tags](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126204).

## Send it

Data should be sent using the [relay](https://docs.devo.com/space/latest/96468993/Devo+Relay).

### Example [relay rules](https://docs.devo.com/space/latest/96469377/Defining+a+relay+rule)

```
         Source message: 
            Source data: 
             Source tag: 
             Target tag: ftp.crushftp.event
Sent without syslog tag: true
        Stop processing: true
```

## Table structure

These are the fields displayed in this table:

| **Field** | **Type** | ***Extra***** field** | **Source field name** |
| --- | --- | --- | --- |
| *eventdate* | `timestamp` |  |  |
| *host* | `str` |  | *vhost* |
| *operation* | `str` |  |  |
| *serverdate* | `str` |  |  |
| *type* | `str` |  |  |
| *msg* | `str` |  |  |
| *session_id* | `str` |  |  |
| *username* | `str` |  |  |
| *src_ip* | `str` |  |  |
| *val_md5* | `str` |  |  |
| *path* | `str` |  |  |
| *crush_auth* | `str` |  |  |
| *current_auth* | `str` |  |  |
| *memory_max* | `str` |  |  |
| *memory_free* | `str` |  |  |
| *threads* | `str` |  |  |
| *hostchain* | `str` | **✓** |  |
| *tag* | `str` | **✓** |  |
| *rawMessage* | `str` |  |  |