Is there a way to see the ip when a user logs in?

General Discussions
1

Don’t know if it’s the right section to ask this.
About 2000 episodes of my tv shows are being deleted yesterday evening and I’d want to know how it happened. Only me and another person have the credentials of the admin account and at the time of the cancelation we were out for dinner. In Plex Media Server.log I find something like this for every show that has been deleted

Sep 03, 2017 18:43:26.059 [0x62bff400] INFO - Library section 2 (Serie TV) will be updated because of a change in /mnt/hd/serie/Detective Monk/Season 1/Monk - Stagione 1
Sep 03, 2017 18:43:26.070 [0x62bff400] VERBOSE - Library section 2 (Serie TV) will be updated because of a change in /mnt/hd/serie/Detective Monk/Season 1/Monk - Stagione 1
Sep 03, 2017 18:43:26.080 [0x62bff400] VERBOSE - Library section 2 (Serie TV) will be updated because of a change in /mnt/hd/serie/Detective Monk/Season 1/Monk - Stagione 1
Sep 03, 2017 18:43:26.091 [0x62bff400] VERBOSE - Library section 2 (Serie TV) will be updated because of a change in /mnt/hd/serie/Detective Monk/Season 1/Monk - Stagione 1
Sep 03, 2017 18:43:26.101 [0x62bff400] VERBOSE - Library section 2 (Serie TV) will be updated because of a change in /mnt/hd/serie/Detective Monk/Season 1/Monk - Stagione 1
Sep 03, 2017 18:43:26.111 [0x62bff400] VERBOSE - Library section 2 (Serie TV) will be updated because of a change in /mnt/hd/serie/Detective Monk/Season 1/Monk - Stagione 1
Sep 03, 2017 18:43:26.122 [0x62bff400] VERBOSE - Library section 2 (Serie TV) will be updated because of a change in /mnt/hd/serie/Detective Monk/Season 1/Monk - Stagione 1
Sep 03, 2017 18:43:26.131 [0x62bff400] VERBOSE - Library section 2 (Serie TV) will be updated because of a change in /mnt/hd/serie/Detective Monk/Season 1/Monk - Stagione 1
Sep 03, 2017 18:43:26.141 [0x62bff400] VERBOSE - Library section 2 (Serie TV) will be updated because of a change in /mnt/hd/serie/Detective Monk/Season 1/Monk - Stagione 1
Sep 03, 2017 18:43:26.151 [0x62bff400] VERBOSE - Library section 2 (Serie TV) will be updated because of a change in /mnt/hd/serie/Detective Monk/Season 1/Monk - Stagione 1
Sep 03, 2017 18:43:26.161 [0x62bff400] VERBOSE - Library section 2 (Serie TV) will be updated because of a change in /mnt/hd/serie/Detective Monk/Season 1/Monk - Stagione 1
Sep 03, 2017 18:43:26.171 [0x62bff400] VERBOSE - Library section 2 (Serie TV) will be updated because of a change in /mnt/hd/serie/Detective Monk/Season 1/Monk - Stagione 1
Sep 03, 2017 18:43:26.182 [0x62bff400] INFO - Library section 2 (Serie TV) will be updated because of a change in /mnt/hd/serie/Detective Monk

And in the Plex Media Scanner Log I find this

Sep 03, 2017 19:24:16.851 [0x745b3000] VERBOSE - Permanently removing media item 376 part 378: /mnt/hd/serie/Legion/Season 1/Legion.1x01.Realta.O.Illusione.ITA.DLMux.x264-UBi.mkv
Sep 03, 2017 19:24:19.142 [0x745b3000] VERBOSE - Permanently removing media item 377 part 379: /mnt/hd/serie/Legion/Season 1/Legion.1x02.Summerland.ITA.DLMux.x264-NovaRip.mkv
Sep 03, 2017 19:24:19.231 [0x745b3000] VERBOSE - Permanently removing media item 378 part 380: /mnt/hd/serie/Legion/Season 1/Legion.1x03.Nelle.Pieghe.Della.Mente.ITA.DLMux.x264-UBi.mkv
Sep 03, 2017 19:24:19.286 [0x745b3000] VERBOSE - Permanently removing media item 379 part 381: /mnt/hd/serie/Legion/Season 1/Legion.1x04.The.Eye.ITA.DLMux.x264-UBi.mkv
Sep 03, 2017 19:24:19.340 [0x745b3000] VERBOSE - Permanently removing media item 380 part 382: /mnt/hd/serie/Legion/Season 1/Legion.1x05.Il.Parassita.ITA.DLMux.x264-UBi.mkv
Sep 03, 2017 19:24:19.394 [0x745b3000] VERBOSE - Permanently removing media item 381 part 383: /mnt/hd/serie/Legion/Season 1/Legion.1x06.Terapia.ITA.ENG.DLMux.XviD-Pir8.avi
Sep 03, 2017 19:24:19.448 [0x745b3000] VERBOSE - Permanently removing media item 382 part 384: /mnt/hd/serie/Legion/Season 1/Legion.1x07.Shadow.King.ITA.DLMux.x264-UBi.mkv
Sep 03, 2017 19:24:19.492 [0x745b3000] VERBOSE - Permanently removing media item 383 part 385: /mnt/hd/serie/Legion/Season 1/Legion.1x08.Guerra.O.Pace.ITA.DLMux.x264-UBi.mkv
Sep 03, 2017 19:24:19.554 [0x745b3000] VERBOSE - Permanently removing directory 68: Legion/Season 1

Is there a way to know from the log the ip of the person who logged in to delete these shows? I know that plexpy logs the ip when a user play a file, is there a log of the accesses or a page to see if someone has logged in my plex.tv account?

Thanks

2

Obviously the very first thing to do is change your password.
To further prevent your media from being deleted like this, in Settings - Server - Library you can uncheck the box which allows media deletion.

What is disconcerting is to click through and delete all those by hand would take time.

To answer your question about if there is a way to log, only PlexPy (a plug-in) would be able to show connections in real time

If you can quickly gather all your logs, I will look in your log files to see what I can learn of the deletion activity and the sign in.

Settings - Server - Help - Download Logs.

It will provide you with a ZIP file which you can attach here with your next post.

3

@ChuckPA said:
Obviously the very first thing to do is change your password.
To further prevent your media from being deleted like this, in Settings - Server - Library you can uncheck the box which allows media deletion.

What is disconcerting is to click through and delete all those by hand would take time.

To answer your question about if there is a way to log, only PlexPy (a plug-in) would be able to show connections in real time

If you can quickly gather all your logs, I will look in your log files to see what I can learn of the deletion activity and the sign in.

Settings - Server - Help - Download Logs.

It will provide you with a ZIP file which you can attach here with your next post.

Hi CuckPA, thanks for your reply. I’ve already changed my password and disabled that option for media deletion.
It’s really strange that someone has logged in my account to delete only some of the tv shows by hand but it’s the only possibility for now, maybe you can get more info from the logs attached!
The first piece of log I posted above was the beginning of the “process” if it can help you

Thanks!

4

Oh brother. Was such a bad idea to start.

if Destructive.Plex > Peoples.Tolerance then  Remove.Feature = true

But as @ChuckPA suggested, try PlexPy.


Although, I’m not sure it will help because PlexPy shows only connected play/pause connections NOT people navigating and deleting items from your library.
In other words, PlexPy will never know someone is on you server until they start to play a file.

5

@andyts93

Unfortunately having ‘Verbose’ logging on (which is not the default) caused all the data to be lost. PMS only keeps the 5 most recent log files by default, rolling over as each log reaches 5MB size. Verbose outputs so much information , the log reaches the 5MB rollover point too quickly.

Giving out the admin password is always a bad idea. I hope you have backups / originals you can re-rip

As I suggested earlier.

  1. Change all the paswords
  2. Disconnect all connected devices (you can do this when you change your password at Plex.tv)
  3. Sign in only those devices you control
  4. Tell the person who had your password that you will ‘share’ with them (which doesn’t give deletion privilege) IF you are still talking to him/her.

Edit: Be absolutely certain to uncheck the box ‘Allow media deletion’ in Settings - Server - Library

If this person has any other passwords, change them as well. Time to get serious.

6

@ChuckPA I’ve followed the steps above, thanks for your help and your time!