SOLVED How to find which IP deleted files from cPanel file manager

[Sarath Kumar R]

Hi,

Please let me know how to find from which IP files were deleted using cpanel. Please help me with this.

 

[SysSachin]

Hello,

You have to check cpanel logs in the file /usr/log/cpanel/logs access_log

 

[cPanelMichael]

Hello,

Yes, as mentioned, File Manager activity is logged to:

/usr/local/cpanel/logs/access_log

You may also want to consider voting for the following feature request:

Built-in filemanager "transfer log"

Thanks!

 

[Sarath Kumar R]

Can you please let me know whether there is any keyword to search.

Hello,

Yes, as mentioned, File Manager activity is logged to:

/usr/local/cpanel/logs/access_log

You may also want to consider voting for the following feature request:

Built-in filemanager "transfer log"

Thanks!

Can you please let me know whether there is any keyword to search.

 

[cPanelMichael]

You can search for the term "filemanager" with a command such as:

grep filemanager /usr/local/cpanel/logs/access_log

However, there's no specific output to let you know if a file was deleted.

Thank you.

 

[Sarath Kumar R]

Grepping file manager won't help much so guys anyone had any other suggestion.

 

[cPanelMichael]

Grepping file manager won't help much so guys anyone had any other suggestion.

You could disable File Manager for the package assigned to the account as part of a custom feature list via "WHM >> Packages >> Edit A Package" and "WHM >> Packages >> Feature Manager". This would require the users to remove files via FTP (assuming SSH access is disabled), which you could then monitor all activity via the /var/log/messages log file.

Beyond that, I encourage you to open a feature request for advanced File Manager logging via:

Submit A Feature Request

Thanks!