By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

ec2 keep deleting my folders under /var/www/ directory

0

Each month, I counter an issue where my files under /var/www/ directory have deleted from nowhere.

I am using Linux with PHP.

Topics
Developer ToolsCompute
Tags
AWS CodeDeployWebsite HostingAmazon EC2
Language
English
Anas
asked a year ago276 views
2 Answers
0

Yes, It disappeared in the same day each month in the same billing day. Although I pay my bills every month.

This is commands results

# cd /etc/cron.monthly/
# sudo crontab -l
no crontab for root

# sudo tail -n 50 /var/log/cron
Apr  6 13:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[4333]: starting 0anacron
Apr  6 13:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[4342]: finished 0anacron
Apr  6 13:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[4333]: starting cron.logcleanup.elasticbeanstalk.healthd-proxy.conf
Apr  6 13:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[4353]: finished cron.logcleanup.elasticbeanstalk.healthd-proxy.conf
Apr  6 13:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[4333]: starting cron.logrotate.elasticbeanstalk.eb-engine.conf
Apr  6 13:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[4360]: finished cron.logrotate.elasticbeanstalk.eb-engine.conf
Apr  6 13:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[4333]: starting cron.logrotate.elasticbeanstalk.eb-hooks.conf
Apr  6 13:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[4367]: finished cron.logrotate.elasticbeanstalk.eb-hooks.conf
Apr  6 13:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[4333]: starting cron.logrotate.elasticbeanstalk.healthd.conf
Apr  6 13:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[4374]: finished cron.logrotate.elasticbeanstalk.healthd.conf
Apr  6 13:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[4333]: starting cron.logrotate.elasticbeanstalk.httpd.conf
Apr  6 13:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[4381]: finished cron.logrotate.elasticbeanstalk.httpd.conf
Apr  6 13:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[4333]: starting cron.logrotate.elasticbeanstalk.web-stderr.conf
Apr  6 13:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[4388]: finished cron.logrotate.elasticbeanstalk.web-stderr.conf
Apr  6 13:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[4333]: starting cron.logrotate.elasticbeanstalk.web-stdout.conf
Apr  6 13:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[4395]: finished cron.logrotate.elasticbeanstalk.web-stdout.conf
Apr  6 13:10:01 ip-172-31-15-66 CROND[4530]: (root) CMD (/opt/elasticbeanstalk/bin/publishlogs -type publish)
Apr  6 13:10:01 ip-172-31-15-66 CROND[4531]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 13:20:01 ip-172-31-15-66 CROND[4654]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 13:30:01 ip-172-31-15-66 CROND[4759]: (root) CMD (/opt/elasticbeanstalk/bin/publishlogs -type publish)
Apr  6 13:30:01 ip-172-31-15-66 CROND[4760]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 13:40:01 ip-172-31-15-66 CROND[4897]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 13:50:01 ip-172-31-15-66 CROND[4982]: (root) CMD (/opt/elasticbeanstalk/bin/publishlogs -type publish)
Apr  6 13:50:01 ip-172-31-15-66 CROND[4983]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 14:00:01 ip-172-31-15-66 CROND[5195]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 14:01:01 ip-172-31-15-66 CROND[5213]: (root) CMD (run-parts /etc/cron.hourly)
Apr  6 14:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[5213]: starting 0anacron
Apr  6 14:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[5222]: finished 0anacron
Apr  6 14:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[5213]: starting cron.logcleanup.elasticbeanstalk.healthd-proxy.conf
Apr  6 14:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[5233]: finished cron.logcleanup.elasticbeanstalk.healthd-proxy.conf
Apr  6 14:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[5213]: starting cron.logrotate.elasticbeanstalk.eb-engine.conf
Apr  6 14:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[5240]: finished cron.logrotate.elasticbeanstalk.eb-engine.conf
Apr  6 14:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[5213]: starting cron.logrotate.elasticbeanstalk.eb-hooks.conf
Apr  6 14:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[5247]: finished cron.logrotate.elasticbeanstalk.eb-hooks.conf
Apr  6 14:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[5213]: starting cron.logrotate.elasticbeanstalk.healthd.conf
Apr  6 14:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[5254]: finished cron.logrotate.elasticbeanstalk.healthd.conf
Apr  6 14:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[5213]: starting cron.logrotate.elasticbeanstalk.httpd.conf
Apr  6 14:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[5261]: finished cron.logrotate.elasticbeanstalk.httpd.conf
Apr  6 14:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[5213]: starting cron.logrotate.elasticbeanstalk.web-stderr.conf
Apr  6 14:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[5268]: finished cron.logrotate.elasticbeanstalk.web-stderr.conf
Apr  6 14:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[5213]: starting cron.logrotate.elasticbeanstalk.web-stdout.conf
Apr  6 14:01:01 ip-172-31-15-66 run-parts(/etc/cron.hourly)[5275]: finished cron.logrotate.elasticbeanstalk.web-stdout.conf
Apr  6 14:10:01 ip-172-31-15-66 CROND[5344]: (root) CMD (/opt/elasticbeanstalk/bin/publishlogs -type publish)
Apr  6 14:10:01 ip-172-31-15-66 CROND[5345]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 14:20:01 ip-172-31-15-66 CROND[5432]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 14:30:01 ip-172-31-15-66 CROND[5563]: (root) CMD (/opt/elasticbeanstalk/bin/publishlogs -type publish)
Apr  6 14:30:01 ip-172-31-15-66 CROND[5564]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 14:40:01 ip-172-31-15-66 CROND[5649]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 14:46:41 ip-172-31-15-66 crontab[6122]: (root) LIST (root)
Apr  6 14:47:12 ip-172-31-15-66 crontab[6130]: (root) LIST (root)
Anas
answered a year ago
  • Riku_Kobayashi EXPERT
    a year ago

    The logs look like you are running EC2 with Elastic Beanstalk.
    Is there anything you are deleting in the Elastic Beanstalk configuration?

    I would like to see the log of the day it was deleted...

  • Anas
    a year ago

    The data was deleted on 4 or 5 this month (April)

    I Didn't delete anything from Elastic Beanstalk configuration since I created it first time.

    This is the full log available for Elastic Beanstalk, you can take a look just to logs in 4 and 5 of April

    https://drive.google.com/drive/folders/10LKvPaVJLe5YgDK9-B5XQ2S-LZRlfwvt?usp=share_link

  • Riku_Kobayashi EXPERT
    a year ago

    Thanks for sharing the log.
    I looked around a bit and no errors seem to be occurring.
    I was looking at "eb-engine.log" and found a log that created a symbolic link from "/var/app/current/" to "/var/www/html

    2023/04/05 20:35:25.401821 [INFO] create soft link from /var/app/current/ to /var/www/html

    I think that "/var/www" appears to disappear when files in the directory "/var/app/current/" disappear.

0

Check to see if cron is set up.
The following directory may contain your settings
ls -la /etc/cron.monthly/

profile picture
EXPERT
Riku_Kobayashi
answered a year ago
  • Anas
    a year ago

    Its empty:

    cd /etc/cron.monthly/

    ll -la

    total 12 drwxr-xr-x 2 root root 6 Oct 18 2017 . drwxr-xr-x 100 root root 8192 Apr 5 20:35 ..

  • Riku_Kobayashi EXPERT
    a year ago

    Does it disappear on the same day each month?

    Also try the following commands

    sudo crontab -l

    Otherwise, check the cron logs for anything else suspicious.

    sudo tail -n 50 /var/log/cron

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content