Some files (folder of some domain /var/www/vhost/www.example.com) on our dev server disappeared [it's an ubuntu 14] I check history, but nothing strange.

So I want to know, otherwise some user do a rm, which are the different way a file could be delete ? (it's distant server)

I know I could delete file with ftp connection, so additional question is how to list all ftp connection with date and ip ?

Thanks by advance,

  • 1
    Did a few random file disappear, or did a specific directory disappear?
    – Kusalananda
    Apr 4 '20 at 19:53
  • This is some website folder, specific directory. Like it was a human which do it.
    – LexaGC
    Apr 4 '20 at 19:59
  • I already check some log, I see request 200 transform to request 404 but thats all . By the way, there are many many logs in a server. Could you be more specific?
    – LexaGC
    Apr 4 '20 at 20:28
  • Perhaps a remote attack?
    – vonbrand
    Apr 5 '20 at 20:08
  • Perhaps, but perhaps not...
    – LexaGC
    Apr 6 '20 at 7:17

Check scripts if any executed for housekeeping. If few files are gone, do check if any log rotation script is running.

Else you can use inotify module

inotifywait -e delete --timefmt %c --format '%T %_e %w %f' -r -m / >/path/logfile
Setting up watches.  Beware: since -r was given, this may take a while!
Watches established.
Fri Jul 19 11:57:39 2013 DELETE /tmp/ testfiletodelete
Fri Jul 19 11:57:46 2013 DELETE /home/user/ testfiletodelete

Please read man page before using it. As including --exclude and some other flags may be useful.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.