Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using Apache with PHP on a Unix server, and some days back someone changed some PHP files. As part of the investigation, I want to know where the FTP log is saved for the same server so that we can track down the responsible person.

share|improve this question

migrated from stackoverflow.com Oct 24 '11 at 9:53

This question came from our site for professional and enthusiast programmers.

    
You are making a mistake by assuming that all file modifications are always done over FTP. It's possible that someone connected using SFTP (which does not log transfers) or edited over SSH directly. – grawity Oct 24 '11 at 10:09
    
Or the server was hacked and files were uploaded through a backdoor. – vtest Oct 24 '11 at 10:11
up vote 0 down vote accepted

If you have logging properly set up, logs are usually here:

/var/log/

specify FTP server you are using to get exact path, or look into FTP server config in /etc/

  • Proftpd: via syslog or /var/log/proftpd.log (config: /etc/proftpd.conf)
  • Pureftpd: /var/log/pureftpd.log (config: /etc/pureftpd/conf/AltLog)
  • Vsftpf: /var/log/vsftpd.log (config: /etc/vsftpd.conf)
share|improve this answer
    
Hi, Thanks for the help. I got Access and error logs in /works folder. – Shatru Oct 24 '11 at 10:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .