As you can see, the username, date and time is shown. The client is distinguishable via the user agent string. The source IP is also shown, which should be correct as long as you don’t have a reverse proxy in front of your ownCloud instance and the logging isn’t set up correctly.
I would like to mention that your ownCloud server version is rather old, and I only had a recent version for copying these log lines available. I would hope that nothing much would have changed regarding this since though.
Hope that get’s you started, let me know should you have any further questions.
Cheers,
Erik
I have compared these entries with login entries from the browser:
“Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0”
or
“Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.98 Safari/537.36”
it looks like other browsers??
I can not distinguish IP because connection to the server is via VPN. In the history of my browser there is a first connection at 16:16 - I tried to check what happened.
Tt’s unlikely it would be a hacking because algorithm of deleting is not trivial.
In a complicated directory structure, several of the oldest files have been deleted.
I cant see the rules - there was a different date in different directory (but always the oldest)
And question for the future:
Is there a way to automatically restore files by date or by logs?
It is not possible to manual restoring 3000 files
I have a backup of course , and i have a laptop unconncted to server at this time so the files are save
This would tell me that it was a sync client. So it only matters what stands behind the DELETE request as user agent string.
See above.
I would assume somebody with sync client access accidentally moved those files out of the synced ownCloud folder, without setting the specific selective sync settings first. Either just to another location on their local disk or into the trash bin because they ran out of disk space on their local machine.
I think the easiest way for you to restore the files would be to use that laptop.
You make a copy of all the files on the laptop
You connect the laptop back up with the ownCloud instance
Wait for it to finish syncing
You copy the files, that you backed up in step 1, into your synced ownCloud folder on the laptop.
While copying it will ask you how you want to merge your folders, chose ‘Skip existing files’ (or whatever it is called on your OS/file browser)
The sync client will upload all new files (the ones that were deleted)