log activities

Discussion in 'Security' started by commandos, Apr 26, 2007.

  1. #1
    Hello ,

    What is the command line to see all activites that occured on a dedicated server .

    like ftp upload , file upload , hack attempt ?

    and suppose there is many site under the server , is there a way to see for a specific site (folder) ?

    Thank's
     
    commandos, Apr 26, 2007 IP
  2. Thibaut

    Thibaut Well-Known Member

    Messages:
    886
    Likes Received:
    26
    Best Answers:
    0
    Trophy Points:
    140
    #2
    Hello,

    using Linux, check /var/log directory
    You will get plenty of info there.

    Cheers !
    Thibaut
     
    Thibaut, May 1, 2007 IP
  3. Juan Pablo Olivera

    Juan Pablo Olivera Peon

    Messages:
    53
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    0
    #3
    Specially these two:

    /var/log/messages - will show most of the activities on the server, also many services log directly there
    /var/log/secure - will show any ssh logins or login attempts

    To find a specific folder you have two options:

    1) Run "updatedb" (it will update the internal system database with all files and folders location) and then "locate <directory_or_file>" and it will print all matches.

    2) Assuming your sites are under /home run: find /home | grep <directory_or_file>
     
    Juan Pablo Olivera, May 11, 2007 IP