User Deleted Own Directory

[WestBend]

How can I check a log of actions on a server. I restored the directory the user deleted but I wanted to be able to check that it was the user who deleted it..

[exodux]

login to shell command on the server through ssh
and then goto the home directory of the user - cd /home/username
and then view the bash history file - pico .bash_history

[exodux]

Also, this is not a cpanel issue. would be best to post these questions on your datacentre's web hosting forum of on another type of forum such as webhostingtalk.com

[chirpy]

It does depend on how they deleted it (shell, script or ftp). Shell is covered above, script you're pretty much out of luck since there's no audit trail for scripts and ftp can be found in /var/log/xferlog

[WestBend]

Thanks for the replies.

exodux : I do agree that at first glance this is not a cpanel issue except that the only way for them to access their account (because I block shell access) is either FTP (Not Cpanel) or the FTP manager IN Cpanel as well as the other tools in Cpanel that allow them to manipulate directories and files etc which is why I posted the question here. I did not know if CPanel logged a user's actions.

Thanks again for the replies!

[WestBend]

One last update. I thought I would contribute some information I found regarding FTP logs.

Check Ftp Logs for Different Types of actions. Make sure you change the username to the user you are searching for

Incoming files : 
more /var/log/xferlog | grep username | grep "_ i "

Outgoing files : 
more /var/log/xferlog | grep username | grep "_ o "

Deleting Files
more /var/log/xferlog | grep username | grep "_ d "

To create file subsets you can download

Incoming files : 
more /var/log/xferlog | grep username | grep "_ i " > path.to.file/ftp.incoming.files.txt

Outgoing files : 
more /var/log/xferlog | grep username | grep "_ o " > path.to.file/ftp.outgoing.files.txt

Deleting Files
more /var/log/xferlog | grep username | grep "_ d " > path.to.file/ftp.delete.files.txt