I am using Apache with PHP on a Unix server, and some days back someone changed some PHP files. As part of the investigation, I want to know where the FTP log is saved for the same server so that we can track down the responsible person.
-
You are making a mistake by assuming that all file modifications are always done over FTP. It's possible that someone connected using SFTP (which does not log transfers) or edited over SSH directly.– u1686_grawityOct 24, 2011 at 10:09
-
Or the server was hacked and files were uploaded through a backdoor.– vtestOct 24, 2011 at 10:11
Add a comment
|
1 Answer
If you have logging properly set up, logs are usually here:
/var/log/
specify FTP server you are using to get exact path, or look into FTP server config in /etc/
- Proftpd: via syslog or
/var/log/proftpd.log
(config:/etc/proftpd.conf
) - Pureftpd:
/var/log/pureftpd.log
(config:/etc/pureftpd/conf/AltLog
) - Vsftpf:
/var/log/vsftpd.log
(config:/etc/vsftpd.conf
)
-
Hi, Thanks for the help. I got Access and error logs in /works folder. Oct 24, 2011 at 10:16