Having a debate over here and not sure how to prove or disprove it. They have an old version of lampp setup on a server, and supposedly it used to run a mirrored copy of a website from another server, and they used it as their dev site before making changes on the real one.
The folder containing all the data on the lampp server is not in /opt/lampp/htdocs, and htdocs isn't a link to the folder on there. So I really think that this folder was just a copy of the live server's files and never actually running to where they could see the site in action.
My question is, what would be the proper way to figure out who is correct? Beyond doing what I already did, I'm not sure how, and not real confident that's a concrete investigation.
Thanks!

I think the search order should be: any startup scripts and configuration files, any log file contents. If you want to investigate further: shell scripts, cron spools, shell history and any backups.

1 members found this post helpful.

I can't find anything that would auto start lampp or anything cron'd either. Nothing in history for any accounts still on there. Nothing in the logs either.

You left out configuration files - do they exist and are they configured for that machine?

Also a big clue - is a database in use by the site, and if so, does it exist on that machine, and if so, are there any host and timestamp fields that would indicate access on that machine?

1 members found this post helpful.

Guess that's my problem for config files, i'm not sure what config files to look at for this particular issue.

No databases, it's just a real basic html thing that looks like it should have been left in the early 2000s :-)

?

1 members found this post helpful.

Access: 2015-01-12 09:15:03.000000000 -0500
Modify: 2008-11-06 17:04:09.000000000 -0500
Change: 2012-09-22 17:22:55.000000000 -0400

Well, I don't know from that, Sorry. Should be a clue to base some comparative analysis against...?

How about digging through either /var/log/apt/history.log* (Ubu) or /var/log/yum.log* (CentOS)?

This assumes it wasn't installed from source.
I love a good mystery, but this one has me stumped.

1 members found this post helpful.

Can't find any smoking guns looking in /var/log either. I'm stumped myself too at this point.

surely there'd be some http log(s) under /var/log/...?

1 members found this post helpful.

If there was, it must have been long rotated out by now or something. or it never existed like I figured :-)

Does it run now? That is, if you start the server and hit the "site" and hit the vhost url (or even localhost), does it give you the page via http?

1 members found this post helpful.

Nothing runs now. I don't even see a process with lampp in the name running on the server. If I hit the IP of the server in a browser from another computer I don't get anything. Only web stuff running on there is webmin which does work at port 10000.

1 members found this post helpful.

A key aspect of this question, and one you alone can know, is the importance of determining whether it ever worked vs the importance of making it work. If you are doing forensics of some sort, then that requires one mindset, whereas if you are trying to work with the site it requires another.

My sense is that maybe you have been handed the task of working with this site mirror with the assumption that it was already working, so should be easy to "just use it"! The question of whether it has ever worked would have emerged from the attempt to do so.

If that perspective is in the ballpark (and of course, it may not be!), then it is probably less important to prove whether it ever worked than to have everyone recognize the current state of the lamp server/site and proceed from that basis.

Based on what we know here, I would conclude that there is no clear evidence that it ever worked on that machine, and unless someone can demonstrate that it did and does now work, there is little point in debating it further with your co-workers. So whoever says it did or does work should put up or shut up, in the nicest way of course, by demonstrating that fact. If not...

Then the question/task becomes one of setting up the/a lamp server as a development mirror for that site. That will shift the burden of work from "use it" to "set this up so that you can use it", which is a separate task that throws off any real or imaginary historical baggage and allows you to progress...

1 members found this post helpful.

Yeah, you are in the ballpark there, pretty close to the situation here. My guess is even if it did work at some point almost a decade ago, and they've lived without it this long, I'm sure they can continue to live without it. Just wish there was a way that I could say, "oh yes there was a site with a name like this one configured long ago but it's broke" or "there's nothing I can find that proves it was ever set up" (which I feel is the case).