This one has got me stumped. I use the ProFTPD FTP server. A user reported that a file he uploaded had disappeared from the server about 85 minutes later when someone else tried to download it. I checked xferlog very carefully for evidence that the file had either been deleted or renamed but found nothing.

The directory in question is accessible only through FTP. I am the only shell user who was logged in during this time and I didn't do anything to cause this. There is a cron job that deletes files from this directory that are older than 14 days but this only runs once a day, it did not run during the time this happened, and in any case should not have deleted a freshly-uploaded file.

Here are the relevant log entries from xferlog:

pec_top.tar.gz was first uploaded successfully to the ftp /support directory by user caeowner connecting from somehost.somewhere.com:

"somehost.somewhere.com","1.2.3.4","UNKNOWN","caeowner","[20/Apr/2007:18:50:49 +0000]",
"STOR pec_top.tar.gz","226","/data/home2/ftp/support/pec_top.tar.gz","17124440","683.094"

85 minutes later, the anonymous user tries unsuccessfully to download pec_top.tar.gz:
"4.3.2.1","4.3.2.1","UNKNOWN","ftp","[20/Apr/2007:20:15:28 +0000]","CWD support","250","-","-","-"
"4.3.2.1","4.3.2.1","UNKNOWN","ftp","[20/Apr/2007:20:15:43 +0000]","RETR pec_top.tar.gz","550","-","-","-"
"4.3.2.1","4.3.2.1","UNKNOWN","ftp","[20/Apr/2007:20:16:03 +0000]","RETR pec_top.tar.gz","550","-","-","-"

60 minutes later, caeowner uploads it again:
"somehost.somewhere.com","1.2.3.4","UNKNOWN","caeowner","[20/Apr/2007:21:16:11 +0000]",
"STOR pec_top.tar.gz","226","/data/home2/ftp/support/pec_top.tar.gz","17124440","672.054"

20 minutes later, the anonymous user downloads it successfully:
"4.3.2.1","4.3.2.1","UNKNOWN","ftp","[20/Apr/2007:21:35:10 +0000]","CWD support","250","-","-","-"
"4.3.2.1","4.3.2.1","UNKNOWN","ftp","[20/Apr/2007:21:35:39 +0000]",
"RETR pec_top.tar.gz","226","/data/home2/ftp/support/pec_top.tar.gz","17124440","20.497"

I don't know what happened between the first upload and the first (unsuccessful) download attempt. I would have expected to see the file deleted or renamed somewhere in between or someone trying to download it from the wrong directory, but I don't see anything like that in the log file. It's a mystery!

Does anyone have a clue?

Can the FTP user set the timestamp on the file? If the timestamp is remotely set, it may appear as <= 14 days old.

An interesting idea, but I don't think this can be done, the logs don't show any evidence that it was done, the user wouldn't have had a reason to do this if he could, and I don't think the cron job was active during the time period in question.

I know this an older post but we're seeing this same issue and your post is the newest I could find and was curious, if by some chance you're still monitoring this thread, if you were ever able to figure out what was happening and where the files were mysteriously disappearing to.

Thanks!