Addon domain folder suddenly emptied ?

[Wagnard]

Hi,
Something weird happened to me a few weeks ago and it did happen +- a year ago too.
I have 1 user on my cPanel / WHM and this user have 3 addons domains.
For whatever reason, all of the addon subdomains folder get emptied.
Note: The addons domain are not deleted, it's just their folders that get emptied.
No issues for the main domain.
I have to restore the files from a backup and I'm ok for another year or so.

Has anyone encountered this in the past and also and most importantly, how do I prevent this ?

Thanks you.

 

[cPRex]

Hey there! That's definitely odd behavior, and not something I'd expect to happen with any automated server processes. I'm actually not even sure where to start looking for information about this since it only happens once a year, so waiting for it to happen again isn't realistic.

Do you see anything in /usr/local/cpanel/logs/access_log related to the affected directory? It may also be worth checking /var/log/messages to see if there were any FTP connections made that would have affected that directory.

 

[Dreamwebhosts]

I would start by checking the access_log closely to see if any suspicious activity for the affected directories.

 

[Wagnard]

Thanks for the suggestions, I'm currently looking at the logs, I'll report back If I see anything weird.

 

[Wagnard]

I finally found out what is causing this.
The folder get emptied when I do a restore of the account.
I can confirm the files are in the backup so why would my addon subdomains folder get emptied on backup restauration of my account ???

 

[cPRex]

You mention the files are there, but is the addon domain itself also part of that backup?

 

[Wagnard]

When I was restoring I didn't tick the option to restore the subdomain. I didn't think the restore would erase the files in place tho.

 

[cPRex]

I would expect a restore to remove files that weren't present in the backup - what if you were restoring because of a compromise and those files need to be overwritten? The whole site will return to the state it was when the backup was created.