Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am using Apache with PHP on a Unix server, and some days back someone changed some PHP files. As part of the investigation, I want to know where the FTP log is saved for the same server so that we can track down the responsible person.

share|improve this question

migrated from stackoverflow.com Oct 24 '11 at 9:53

This question came from our site for professional and enthusiast programmers.

    
You are making a mistake by assuming that all file modifications are always done over FTP. It's possible that someone connected using SFTP (which does not log transfers) or edited over SSH directly. –  grawity Oct 24 '11 at 10:09
    
Or the server was hacked and files were uploaded through a backdoor. –  vtest Oct 24 '11 at 10:11

1 Answer 1

up vote 0 down vote accepted

If you have logging properly set up, logs are usually here:

/var/log/

specify FTP server you are using to get exact path, or look into FTP server config in /etc/

  • Proftpd: via syslog or /var/log/proftpd.log (config: /etc/proftpd.conf)
  • Pureftpd: /var/log/pureftpd.log (config: /etc/pureftpd/conf/AltLog)
  • Vsftpf: /var/log/vsftpd.log (config: /etc/vsftpd.conf)
share|improve this answer
    
Hi, Thanks for the help. I got Access and error logs in /works folder. –  Shatru Oct 24 '11 at 10:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.