Unknown User deleted files

  • Resolved mtanase

    (@mtanase)


    8 months, 1 week ago

    Hi,

    I am concerned about these types of records:

    AttachmentID: 14675
    FileName: File-454-DEL-11_07_23.pdf
    FilePath: /var/www/html/wordpress/wp-content/uploads/2024/06
    ClientIP: ip of the server
    Severity: 250
    Object: file
    EventType: deleted
    UserAgent: WordPress/6.5.5;
    Username: Unknown User

    A user ‘unknown user’ has deleted several files ! How can I solve and stop these attempts to delete files ?

Viewing 1 replies (of 1 total)
  • Plugin Support Lucian Padureanu

    (@lucianwpwhite)

    Hello Marian!

    We have received your query regarding the alert on your WordPress site, which shows “unknown” as the actor of certain activities reported by our plugin.

    Based on the details you provided, we have a likely explanation for this occurrence, and there’s nothing to worry about. It appears that the activities you are seeing as “unknown” might be due to a background cleaning process responsible for maintaining the site files, by doing regular cleanups (such as in the reported example – /wp-content/uploads ).

    When such automated tasks are executed by the system (coming from a custom plugin most probably), they do not have a specific user associated with them, and the actual actor here is the server, as confirmed by the IP Address captured for this specific alert/example.

    As a result, the plugin logs this activity under an “unknown” user. This is a common scenario for tasks handled by cron jobs, as they run independently of any logged-in user session. We will try to better improve the Actor area of alerts with more and more comprehensive data, so that we can avoid confusion for sure!

    Please note that this is our best guess based on the information currently available. If there are any additional details or patterns you have noticed, feel free to share them with us. We can then investigate further to provide a more accurate and comprehensive explanation.

    If you have any questions or need further assistance, please do not hesitate to reach out.

    Best regards,
    Lucian

Viewing 1 replies (of 1 total)
  • The topic ‘Unknown User deleted files’ is closed to new replies.