The reason of deleting user information

Dec 27, 2019
10
0
1
doubai
cPanel Access Level
Root Administrator
Hello, i use whm and cloudlinux. Information of a user public_html directory was removed , not by me
But user said that he didn’t remove that too.

How can i find the reason of deleting data inside the public_html directory ?!

Where i have to check in whm for debugging this problem?
 
Last edited by a moderator:

quietFinn

Well-Known Member
Feb 4, 2006
1,693
350
438
Finland
cPanel Access Level
Root Administrator
Before anything else it might be good the check the wastebasket, in /homeUSERNAME/.trash

Customers sometimes accidentally remove things...
 

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
12,497
1,967
363
cPanel Access Level
Root Administrator
WHM and the operating system itself doesn't keep a log of every user transaction, as that would just be an incredible amount of data to sort through on a busy server.

One thing you can check is the FTP transaction logs in /var/log/messages to see if there were any connections to that particular user during the time when the files may have been deleted. You could also check /var/log/secure for SSH connections to the same user, if SSH connections are enabled for that user's account.
 
  • Like
Reactions: aria_opensource