The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

User Deleted Own Directory

Discussion in 'General Discussion' started by WestBend, Sep 29, 2004.

  1. WestBend

    WestBend Well-Known Member

    Joined:
    Oct 12, 2003
    Messages:
    173
    Likes Received:
    0
    Trophy Points:
    16
    How can I check a log of actions on a server. I restored the directory the user deleted but I wanted to be able to check that it was the user who deleted it..
     
  2. exodux

    exodux Well-Known Member

    Joined:
    Apr 12, 2004
    Messages:
    66
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    Brisbane, Queensland, Australia
    login to shell command on the server through ssh
    and then goto the home directory of the user - cd /home/username
    and then view the bash history file - pico .bash_history
     
  3. exodux

    exodux Well-Known Member

    Joined:
    Apr 12, 2004
    Messages:
    66
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    Brisbane, Queensland, Australia
    Also, this is not a cpanel issue. would be best to post these questions on your datacentre's web hosting forum of on another type of forum such as webhostingtalk.com
     
  4. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,475
    Likes Received:
    20
    Trophy Points:
    38
    Location:
    Go on, have a guess
    It does depend on how they deleted it (shell, script or ftp). Shell is covered above, script you're pretty much out of luck since there's no audit trail for scripts and ftp can be found in /var/log/xferlog
     
  5. WestBend

    WestBend Well-Known Member

    Joined:
    Oct 12, 2003
    Messages:
    173
    Likes Received:
    0
    Trophy Points:
    16
    Thanks for the replies.

    exodux : I do agree that at first glance this is not a cpanel issue except that the only way for them to access their account (because I block shell access) is either FTP (Not Cpanel) or the FTP manager IN Cpanel as well as the other tools in Cpanel that allow them to manipulate directories and files etc which is why I posted the question here. I did not know if CPanel logged a user's actions.

    Thanks again for the replies!
     
  6. WestBend

    WestBend Well-Known Member

    Joined:
    Oct 12, 2003
    Messages:
    173
    Likes Received:
    0
    Trophy Points:
    16
    One last update. I thought I would contribute some information I found regarding FTP logs.

    Check Ftp Logs for Different Types of actions. Make sure you change the username to the user you are searching for

    Code:
    Incoming files : 
    more /var/log/xferlog | grep username | grep "_ i "
    
    Outgoing files : 
    more /var/log/xferlog | grep username | grep "_ o "
    
    Deleting Files
    more /var/log/xferlog | grep username | grep "_ d "
    To create file subsets you can download

    Code:
    Incoming files : 
    more /var/log/xferlog | grep username | grep "_ i " > path.to.file/ftp.incoming.files.txt
    
    Outgoing files : 
    more /var/log/xferlog | grep username | grep "_ o " > path.to.file/ftp.outgoing.files.txt
    
    Deleting Files
    more /var/log/xferlog | grep username | grep "_ d " > path.to.file/ftp.delete.files.txt
    
     
Loading...

Share This Page