As this conversation is going nowhere, how about something useful for everyone!
I setup a new server on my laptop, added some media, and then deleted it, and then looked at the logs.
Here’s what the logs show:
Nov 18, 2018 12:42:25.745 [0x700008392000] DEBUG - Request: [127.0.0.1:65198 (Loopback)] DELETE /library/metadata/2 (9 live) GZIP Signed-in Token (niavasha)
Nov 18, 2018 12:42:25.879 [0x700008392000] DEBUG - Deleting media item 2.
Nov 18, 2018 12:42:25.880 [0x700008392000] DEBUG - Was connected to metadata item 2, count is now 0.
Nov 18, 2018 12:42:25.881 [0x700008392000] DEBUG - Destroying metadata item 2 (2018-10-26T23_19_00.000Z_2018-10-26T23_20_00.000Z)
Nov 18, 2018 12:42:25.886 [0x7000079d9000] DEBUG - Completed: [127.0.0.1:65198] 200 DELETE /library/metadata/2 (9 live) GZIP 140ms 268 bytes (pipelined: 3)
As you can see, you MUST have debug enabled (https://support.plex.tv/articles/200289496-general/) - I don’t know whether this is a new default on new installs, but, it was turn on for this install on my Mac, but wasn’t on my install on my machine when the delete occurred, I only had WARN enabled, so, I’ll be enabling DEBUG going forward. I’d rather manage some extra log files and know what’s going on.
Second thing is that as well as giving you the media index number which is 2 in this case, it also does show me the media name, but, as it’s from my own media it’s not obvious what it is, so the filename is “2018-10-26T23_19_00.000Z_2018-10-26T23_20_00.000Z”, so the logs include both and I can see who and where from the request to delete originated from.
Another thing everyone might want to do is to review your list of Authorized Devices, which you can see,
here : https://app.plex.tv/desktop#!/settings/devices/all
Even though I had reset my password, it doesn’t expire the tokens used for granting access to devices not using a password. I found a bunch of old stuff in there I wasn’t too sure on, and… one app in particular that I have absolutely no idea what it is from about a month ago, called “ATFN” which showed up as an Android app, but, does not produce anything on a google search. Be careful with what you add.
Lastly, if you are running on Linux, you will be able to use the SELinux system to trace all delete events occurring on the system.
