Which logs store information about file operations by customer?

Question

Which logs store information about the file operations by a customer through Plesk File Manager or via FTP?

Answer

• Records about establishing of FTP session can be found in the file /var/log/secure:

  1. Connect to the server using SSH.

  2. Open the file /var/log/secure and search for corresponding records. Sample of log entries is provided below:

     # less /var/log/secure
     Jan 12 19:24:44 hostname proftpd: pam_unix(proftpd:session): session opened for user test_ftp_user by (uid=0)
     Jan 12 19:24:44 hostname proftpd[1624]: 0.0.0.0 (10.0.0.1[10.0.0.2]) - USER test_ftp_user: Login successful.
     ...
     Jan 12 19:24:48 hostname proftpd: pam_unix(proftpd:session): session closed for user test_ftp_user

• The records about the FTP operations are written to the file /var/log/plesk/xferlog:

  1. Connect to the server using SSH.

  2. Open the file /var/log/plesk/xferlog and search for corresponding records. The sample entries are provided below:

     # less /var/log/plesk/xferlog
     Fri Nov 09 14:06:16 2018 0 203.0.113.2 21653 /var/www/vhosts/example.com/some_file b _ i r ftpuser ftp 0 * c
     Fri Nov 09 14:06:50 2018 0 203.0.113.2 21653 /var/www/vhosts/example.com/error_docs/some_file2 a _ d r ftpuser ftp 0 * c

  The format of the records in this log can be found here.

• Opening of Plesk File Manager is logged to the file /var/log/plesk/httpsd_access_log:

  1. Connect to the server using SSH.

  2. Open the log /var/log/plesk/httpsd_access_log and search for corresponding records. Sample of log entries is provided below:

     # less /var/log/plesk/httpsd_access_log
     203.0.113.2 - - [12/Jan/2018:19:42:47 +0700] "GET /smb/task/task-progress/ HTTP/1.1" 200 22 "https://192.0.2.2:8443/smb/file-manager/list/domainId/2" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0" "-"'/smb/task/task-progress/' '' '/usr/local/psa/admin/htdocs'
     203.0.113.2 - - [12/Jan/2018:19:42:55 +0700] "GET /smb/web/overview/id/d%3A2 HTTP/1.1" 200 112748 "https://192.0.2.2:8443/smb/file-manager/list/domainId/2" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0" "-"'/smb/web/overview/id/d:2' '' '/usr/local/psa/admin/htdocs'

     where 203.0.113.2 - IP address Plesk was accessed from, 192.0.2.2 - IP address or hostname of the server, domainId/2 - ID of a domain which File Manager was accessed.

  3. Domain ID can be found with the following query in Plesk database:

     # plesk db -e"select id from domains where name='example.com'"

  Note: File management operations through Plesk File Manager are logged in /var/log/plesk/panel.log when Plesk debug is enabled. 

  You can upvote the feature request on Plesk UserVoice portal mentioning the possibility to see the actions without having to enable the debug mode.