What protocol is being used in the right-clicked "save as"? Ftp managed by the browser? Http?

Whichever protocol is specified in the link. If the link says http://..., HTTP will be used. If the link says ftp://..., FTP will be used. The only difference is between clicking on the link normally and using save-as is what the browser does with the downloaded file. The former displays it, while the latter saves it to disk.

All major web browsers of the last eon should have both HTTP and FTP clients built in, so they can handle both HTTP and FTP links seemlessly.

Does this act appear in the web server log so that I can programmatically find and record the download data?

If HTTP is used, it'll appear in your web server logs.
If FTP is used, it'll appear in your FTP server logs.