Sanket More

Registered
Feb 6, 2016
2
0
1
India
cPanel Access Level
Root Administrator
Hi

I need to find whether the files were delered from file manager I know the log location but cannot read who deleted the files

Can someone help on how to read the cPanel access log for troubleshooting ?

Does the access log have such information or it can only provide when and who accessed the cPanel.
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,913
2,202
363
Hello :)

File Manager activity is logged to:

/usr/local/cpanel/logs/access_log

You could try searching this log for the account username to help narrow down the result output. EX:

Code:
grep $username /usr/local/cpanel/logs/access_log
Thank you.
 

Sanket More

Registered
Feb 6, 2016
2
0
1
India
cPanel Access Level
Root Administrator
Hello :)

File Manager activity is logged to:

/usr/local/cpanel/logs/access_log

You could try searching this log for the account username to help narrow down the result output. EX:

Code:
grep $username /usr/local/cpanel/logs/access_log
Thank you.
Thanks but I wish to know whether the file was deleted, moved or renamed etc.

Can you give sample of such logs?
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,913
2,202
363
The type of logging you are looking for is not available for File Manager (e.g. "File1 Deleted by UserX"). Here's an example of the output you will see in /usr/local/cpanel/logs/access_log when deleting a file:

Code:
1.1.1.1 - username [02/11/2016:19:06:28 -0000] "GET /cpsess6253663150/frontend/paper_lantern/mimeicons/text-html.png HTTP/1.1" 200 0 "https://10.10.10.10:2083/cpsess6253663130/frontend/paper_lantern/filemanager/index.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:43.0) Gecko/20100101 Firefox/43.0" "s" "-" 2083
1.1.1.1 - username [02/11/2016:19:06:28 -0000] "GET /cPanel_magic_revision_1453708394/frontend/paper_lantern/filemanager/img/panel/close.gif HTTP/1.1" 200 0 "https://10.10.10.10:2083/cPanel_magic_revision_1453708394/frontend/paper_lantern/filemanager/css/tree_styles2_optimized.css" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:43.0) Gecko/20100101 Firefox/43.0" "s" "-" 2083
1.1.1.1 - username [02/11/2016:19:06:36 -0000] "POST /cpsess6253663150/json-api/cpanel HTTP/1.1" 200 0 "https://10.10.10.10:2083/cpsess6253663130/frontend/paper_lantern/filemanager/index.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:43.0) Gecko/20100101 Firefox/43.0" "s" "-" 2083
Thank you.