Question Logs question ?

[Richard Follett]

So I am trying to solve a problem with regards to files being added to my Wordpress site.
I found this in a Plugin Log:

May 14, 2017 10:47 pm system 127.0.0.1 File modified wp-content/wflogs/config.php (old size: 615638, new size: 615638)
May 14, 2017 10:23 am system 127.0.0.1 File modified wp-content/wflogs/config.php (old size: 615638, new size: 615638)
May 14, 2017 10:23 am system 127.0.0.1 New file added wp-admin/ms-log.php (size: 342)

So I know when the bad file (ms-log.php) was added... so now I am looking in the Plesk logs but they only seem to show for last 24 hours? See this screen shot:

Screenshot

if I change the date to narrow range it does nothing? If I hit refresh it does nothing?

I guess somewhere there is a setting for how long these logs are kept?

 

[UFHH01]

Hi Richard Follett,

pls. find the log - locations at the official Plesk Knowledge - Base:

=> Plesk for Linux services logs and configuration files ( KB - article: 213403509 )​

Rotated domain - specific log - files can be found at: => /var/www/vhosts/system/(sub.).YOUR-DOMAIN.COM/logs

... while your log - rotation settings depend on your service/hosting/addons plan - settings:

Example: HOME > Service Plans > YOUR-SERVICE-PLAN-NAME > (tab) Logs & Statistics​

 

[Richard Follett]

Thank you but still bit confused!

Screenshot - from here I click on Logs and see this:

Screenshot

I want to put a date in - say 4 days ago and it does not show from that day?

when you say /var/www/vhosts/system/(sub.).YOUR-DOMAIN.COM/logs

how do I view this?

 

[Richard Follett]

found these

Screenshot

still not much help - I need to see all the POST commands from 14th May

 

[Richard Follett]

i found my log rotation settings

Screenshot

so as it was small I have now set to monthly but that does not help me - becuase it was set to 5120kb then only few days I guess?

 

[Richard Follett]

Can I see when I last logged into my plesk Dashboard? Is there a log for this?

 

[Bitpalast]

It's not being logged by default. Maybe (have not tried it) it is logged in debug mode: How to enable/disable debug logging in Plesk 11.5 and higher for Linux , because debug mode is logging an incredibly huge number of transactions.

 

[Richard Follett]

I found the Plesk Action log which tells me when I lasted logged into my Plesk dashboard which is good.. Checking all options.. still no idea how they added files!

Thank you

 

[Bitpalast]

The IP address says 127.0.0.1, so probably another script has created the file.

 

[Richard Follett]

Thanks Peter