Ho to find what files were deleted using FTP?

[Constantin]

Hi,

I need to find out what files were deleted using FTP, and the IP that was used.

I use pure-fptd, and I only saw in logs (ftpxferlog) files that were transfered, and not the one that were deleted.

Thanks,
Constantin

 

[sneader]

Hi Constantin. We just ran into this same thing today.

We were shocked/surprised that the "ftp logs" that the customer can download do not contain any information about files that were deleted via FTP.

We were able to help the customer investigate his problem by searching the /var/log/messages.* logs. BUT... why do the customer's FTP logs, that they can access via their cPanel, not contain this information?

Anybody know, before I open a ticket to ask?

- Scott