/tmp full of pictures which were properly uploaded by a php script

[Tagor]

How can I find out who uploaded a lot of files to the /tmp folder without removeing them? I downloaded some of the files and replaced their extension with ".jpg". It seem to be pictures that were generated by a php script. How can I find out which script generated them?

[Tagor]

Kick .......

[PWSowner]

Assuming the files don't have a username as the owner or group, you may have to either search for php files that generate images, but that can be a lot of searching if you have a lot of clients, or you could look at the log files and find out what was running at the exact time the images were created.

[Tagor]

Assuming the files don't have a username as the owner or group, you may have to either search for php files that generate images, but that can be a lot of searching if you have a lot of clients, or you could look at the log files and find out what was running at the exact time the images were created.

What logs files do you mean? The domlogs?

The owner is "nobody" (php)

[PWSowner]

The domlogs would be the most likely place. I don't know if php writes to it's own log file or not, not that I know of. I know perl does, but that doesn't help when php is what we're looking for.

Just go in shell and
cd /usr/local/apache/domlogs
tail -n 500 domain.com for each domain that you think it could be.

Could also download the logs to make it easier to look them over.

[Tagor]

The domlogs would be the most likely place. I don't know if php writes to it's own log file or not, not that I know of. I know perl does, but that doesn't help when php is what we're looking for.

Just go in shell and
cd /usr/local/apache/domlogs
tail -n 500 domain.com for each domain that you think it could be.

Could also download the logs to make it easier to look them over.

Looking in over 300 domains is a bit much, sorry :X.