Account Deletion Log

[aodat2]

Does anyone know if there is a way to actually get a log of who deleted the account from my reseller or etc? It seems that someone has deleted an account from my reseller's account and now they are blaming me for doing so.

It seems that this is kinda impossible for us to do as if I were to do it, I won't be so free to only delete 1 of my reseller's customer domain(user) and leave the rest intact.

Hope someone could tell me if there's a log or something kept which could tell me where/who deleted it and when it happened and etc.

Thank you.

 

[zEitEr]

Check /var/log/directadmin/system.log active and rotated

You would see something like:

2010:12:14-14:55:30: User ***** removed by admin

2010:12:14-14:56:05: httpd restarted
2010:12:14-14:56:05: named reloaded
2010:12:14-14:56:05: proftpd rereaded

Then you can found IP of the session by examing other logs for that period.

E.x.

# cat /var/log/directadmin/2010-Nov-14.log | grep admin
14/12/2010:14:53:09     217.***.***.8 GET /CMD_ALL_USER_SHOW HTTP/1.1     admin
14/12/2010:14:55:15     217.***.***.8 GET /CMD_SELECT_USERS HTTP/1.1      admin
14/12/2010:14:55:16     217.***.***.8 GET /CMD_SELECT_USERS HTTP/1.1      admin

 

[nobaloney]

The DirectAdmin admin level login has a Log Viewer which offers you views into several DirectAdmin logs.

Jeff

 

[zEitEr]

Time has gone, aodat2 needs to search through archived (rotated) logs. They're not accessible via DirectAdmin.

 

[KimBruil]

I'm searching information on who deleted an specific domain/account. Is this still a thing? When I check the system logs I only see tails..