It's me again, the one with the questions no one seems to be able to answer. Got some more:

I have a user (maybe more) who is deleting files from my Samba shares. They are either doing this via Samba (Windows Networking) or via FTP. They do not have console access.

Samba logs at level 2 with who opened and closed what file. Level 3 has a lot of detail, but I didn't see anything in it (though it was a lot) that says they deleted the file (I tested it with a file I purposefully deleted).

Likewise, via VSFTP I can't even interpret the log file to see who is doing what to what file. I see what files they've touched and /or accessed, but don't know what the rest of it means.

Any suggestions?

If you don't want particular files deleted, invoke the sticky bit. It allows users to edit, execute but not delete. It sounds to me though someone is deleting by vsftpd, which probably isn't logged by default. Not even sure if you can enable it, try reading up on their docs though.

I'm curious why you think it's being done via VSFTP?

I have enabled logging on VSFTP following their documentation. It now shows me who deleted what and when.

As far as the sticky bit, one) How would I do that? And two) there are some users who need to be able to delete certain files....can this be done with the "sticky bit"?