2

My problem is as follows:

I have one Magento community site, hosted on a virtual machine. I have two environments: PROD and DEV.

1,400 + products have been deleted from my PROD store.

My question is - are there activity logs that provide information (i.e. IP address of computer) that have actioned events from the Administration login?

I appreciate that there are some modules available that provide this information, but only going forward, not retrospectively.

Any help would be very much appreciated.

1

In Magento 2 Opensource (Community) version, there is no default way to log admin user's activity.

Still there may be some clues:

  1. The table admin_user_session keeps the session information about all the admin users (if not truncated/deleted/modified manually).
  2. You can check server's access.log to know the requests sent to your web server using a browser.

It may not get back your precious data, but it may help you to find the culprit.

Once you recover/ignore your data, you can install a custom extension to track the activity.

Also, change server login access, Magento admin panel access, mySQL login details as soon as possible and never share it with anyone you don't trust.

  • Thank you very much for your response. I have investigated the admin_user_access table. There is an entry in user_id column marked as NULL which immediately precedes the mass deletion (I think). There are only two other user_ID's: 1 & 2. Could this mean an account has been created and then deleted retrospectively? – Deadulus Oct 11 '18 at 9:20
  • It may be possible. – Mohit Kumar Arora Oct 11 '18 at 10:38
  • Thank you for your quick reply - this is what I suspected. I assume this would be difficult to verify? – Deadulus Oct 11 '18 at 10:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.