In the proftpd.conf, the DA update will change: LogFormat userlog "%u %b" to be: LogFormat userlog "%u %b %m" in order to add the command used along with the bytes, so that DA can then parse out to see what command was called. DA will then only count the lines that use STOR or RETR. Other non-transfer commands will be ignored. The problem was that the renaming or deleteing (etc) of a file are all part of the "WRITE" or "READ" format, so get logged when we only want a subset of that data. This allows DA to pick out what it wants.