up vote 0 down vote favorite
share [g+] share [fb]

I am using Apache with PHP on a Unix server, and some days back someone changed some PHP files. As part of the investigation, I want to know where the FTP log is saved for the same server so that we can track down the responsible person.

link|improve this question
You are making a mistake by assuming that all file modifications are always done over FTP. It's possible that someone connected using SFTP (which does not log transfers) or edited over SSH directly. – grawity Oct 24 '11 at 10:09
Or the server was hacked and files were uploaded through a backdoor. – vtest Oct 24 '11 at 10:11
feedback

migrated from stackoverflow.com Oct 24 '11 at 9:53

This question came from our site for professional and enthusiast programmers.

1 Answer

up vote 0 down vote accepted

If you have logging properly set up, logs are usually here:

/var/log/

specify FTP server you are using to get exact path, or look into FTP server config in /etc/

  • Proftpd: via syslog or /var/log/proftpd.log (config: /etc/proftpd.conf)
  • Pureftpd: /var/log/pureftpd.log (config: /etc/pureftpd/conf/AltLog)
  • Vsftpf: /var/log/vsftpd.log (config: /etc/vsftpd.conf)
link|improve this answer
Hi, Thanks for the help. I got Access and error logs in /works folder. – Shatru Oct 24 '11 at 10:16
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.