The following is the GNU All-permissive License as recommended in

Copyright (C) 2024 Free Software Foundation

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved. This file is offered as-is, without any warranty.

Contributions are welcome. See


auditd can be used to track for when a file is deleted, and provides some information about who or what process deleted that file. It can track other system or file changes as well.

Install the package:

apt install auditd


Set up an audit tracker (set 'foo' to some custom string):

auditctl -w /var/www/html/some_file -p wra -k foo

Search the logs for entries:

ausearch -k foo -i

Get some other general stats:

aureport -ts today -i -x --summary

Remove an audit tracker (notice the uppercase 'W'):

auditctl -W /var/www/html/some_file -p wra -k foo


Some reads and writes may not be tracked. It's complicated stuff, but check the -p option in man auditctl.