Question How to check logs if any file or folder is deleted from vhost directory?

[kartik]

Server operating system version

Ubuntu 18.04

Plesk version and microupdate number

Plesk Obsidian 18.0.28

We are checking our instance and we found some files and folders are deleted from document root directory. Is there any way to check who deleted those files and folders?

 

[mow]

Not really. There are many ways to delete files, some have their own logs (e.g. plesk panel log; xferlog for ftpd), others are easily circumventable (shell history). Your best bet would be to narrow down when they vanished and check the authlog for who was on at that time. If you didn't change anything else in the document root, the change time of the directory might help.