FTP and SFTP logs track in CentOS

Question

How it is possible to track the changes made to a directory using tools like FileZilla or XFTP ? because we found some files suddenly got missed from server, in history also nothing was found so wondering what is a good way to handle this kind a situation in future. if there is a way to at least the logs as in what files are copied and what files are removed from the directory and modified times and etc

I am very new to this area, so appreciate any suggestion.

Thanks

Solution 1

FTP logs are usually found in /var/log/messages and sftp logs in /var/log/secure. But if the ftp and sftp aren't configured, the info present in the logs wouldn't be useful enough to check what you need presently. If you have setup 3rd party ftp server like pure-ftpd then you can configure it to have detailed log. Also you can configure it to have a separate log other than /var/log/messages

Solution 2

retro-actively; no.

By default the SFTP server does not log actions, only the login events for SSH/SFTP are logged in /var/log/secure.
The default plain FTP server vsftpd does log some actions /var/log/xferlog; get and put actions are logged but when I tested the FTP dele commands were not :(

Still that may be sufficient to determine if anyone was logged in at the assumed time modifications where made, but that's all.

For future purposes you can change your system configuration to log more verbosely or take a look at auditd