ftp server compromise

Where can I find information on reading ftp logs. I had a server compromised recently and found what appeared to be a new file that was actually a “com port mapping” that I couldn’t delete. I know that the ip of the hackers is probably spoofed but I would like to get as much info from the log so that I can secure the server before restarting. Also does anyone have any helpful security hints? I have a simple port filtering firewall box (dlink).