The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

/tmp full of pictures which were properly uploaded by a php script

Discussion in 'General Discussion' started by Tagor, Nov 6, 2004.

  1. Tagor

    Tagor Well-Known Member

    Joined:
    Mar 6, 2004
    Messages:
    193
    Likes Received:
    0
    Trophy Points:
    16
    How can I find out who uploaded a lot of files to the /tmp folder without removeing them? I downloaded some of the files and replaced their extension with ".jpg". It seem to be pictures that were generated by a php script. How can I find out which script generated them?
     
  2. Tagor

    Tagor Well-Known Member

    Joined:
    Mar 6, 2004
    Messages:
    193
    Likes Received:
    0
    Trophy Points:
    16
    Kick ....... :)
     
  3. PWSowner

    PWSowner Well-Known Member

    Joined:
    Nov 10, 2001
    Messages:
    2,948
    Likes Received:
    3
    Trophy Points:
    38
    Location:
    ON, Canada
    Assuming the files don't have a username as the owner or group, you may have to either search for php files that generate images, but that can be a lot of searching if you have a lot of clients, or you could look at the log files and find out what was running at the exact time the images were created.
     
  4. Tagor

    Tagor Well-Known Member

    Joined:
    Mar 6, 2004
    Messages:
    193
    Likes Received:
    0
    Trophy Points:
    16
    What logs files do you mean? The domlogs?

    The owner is "nobody" (php)
     
  5. PWSowner

    PWSowner Well-Known Member

    Joined:
    Nov 10, 2001
    Messages:
    2,948
    Likes Received:
    3
    Trophy Points:
    38
    Location:
    ON, Canada
    The domlogs would be the most likely place. I don't know if php writes to it's own log file or not, not that I know of. I know perl does, but that doesn't help when php is what we're looking for.

    Just go in shell and
    cd /usr/local/apache/domlogs
    tail -n 500 domain.com
    for each domain that you think it could be.

    Could also download the logs to make it easier to look them over.
     
  6. Tagor

    Tagor Well-Known Member

    Joined:
    Mar 6, 2004
    Messages:
    193
    Likes Received:
    0
    Trophy Points:
    16
    Looking in over 300 domains is a bit much, sorry :X.
     
Loading...

Share This Page