Linux - ServerThis forum is for the discussion of Linux Software used in a server related context.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
This one has got me stumped. I use the ProFTPD FTP server. A user reported that a file he uploaded had disappeared from the server about 85 minutes later when someone else tried to download it. I checked xferlog very carefully for evidence that the file had either been deleted or renamed but found nothing.
The directory in question is accessible only through FTP. I am the only shell user who was logged in during this time and I didn't do anything to cause this. There is a cron job that deletes files from this directory that are older than 14 days but this only runs once a day, it did not run during the time this happened, and in any case should not have deleted a freshly-uploaded file.
Here are the relevant log entries from xferlog:
pec_top.tar.gz was first uploaded successfully to the ftp /support directory by user caeowner connecting from somehost.somewhere.com:
20 minutes later, the anonymous user downloads it successfully:
"4.3.2.1","4.3.2.1","UNKNOWN","ftp","[20/Apr/2007:21:35:10 +0000]","CWD support","250","-","-","-"
"4.3.2.1","4.3.2.1","UNKNOWN","ftp","[20/Apr/2007:21:35:39 +0000]",
"RETR pec_top.tar.gz","226","/data/home2/ftp/support/pec_top.tar.gz","17124440","20.497"
I don't know what happened between the first upload and the first (unsuccessful) download attempt. I would have expected to see the file deleted or renamed somewhere in between or someone trying to download it from the wrong directory, but I don't see anything like that in the log file. It's a mystery!
Can the FTP user set the timestamp on the file? If the timestamp is remotely set, it may appear as <= 14 days old.
An interesting idea, but I don't think this can be done, the logs don't show any evidence that it was done, the user wouldn't have had a reason to do this if he could, and I don't think the cron job was active during the time period in question.
I know this an older post but we're seeing this same issue and your post is the newest I could find and was curious, if by some chance you're still monitoring this thread, if you were ever able to figure out what was happening and where the files were mysteriously disappearing to.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.