0

I am using Apache with PHP on a Unix server, and some days back someone changed some PHP files. As part of the investigation, I want to know where the FTP log is saved for the same server so that we can track down the responsible person.

2
  • You are making a mistake by assuming that all file modifications are always done over FTP. It's possible that someone connected using SFTP (which does not log transfers) or edited over SSH directly. Oct 24, 2011 at 10:09
  • Or the server was hacked and files were uploaded through a backdoor.
    – vtest
    Oct 24, 2011 at 10:11

1 Answer 1

0

If you have logging properly set up, logs are usually here:

/var/log/

specify FTP server you are using to get exact path, or look into FTP server config in /etc/

  • Proftpd: via syslog or /var/log/proftpd.log (config: /etc/proftpd.conf)
  • Pureftpd: /var/log/pureftpd.log (config: /etc/pureftpd/conf/AltLog)
  • Vsftpf: /var/log/vsftpd.log (config: /etc/vsftpd.conf)
1
  • Hi, Thanks for the help. I got Access and error logs in /works folder. Oct 24, 2011 at 10:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .