Recently I've had to research on some missing files of a website.
When looking through the proftpd xferlog files, it was clear that the files were deleted by a user having ftp access.
The xferlog file is usually located at "/var/log/xferlog". However, since this was a plesk server, it was located at:
"/var/www/vhosts/{DOMAIN}/statistics/logs/xferlog_regular*"
A quick grep produced the files that were deleted out and could easily be recovered from a previous backup. Also, discovered the time and offending IP address of the person that did the deletes.
Full listing:
$ grep "_ d" /path/to/xferlogListing of just the deleted files:
$ awk '/_ d/ {print $9}' /path/to/xferlogBelow are some additional notes on xferlog anlysis:
