Here is the error log (not necessarily in chronological order). I deleted the log files already because when I have file access logging turned on it fills up fast. All of the email notifications came in at the same time, so I don’t know chronological order.
Event: create, Path: /projects/<PRIVATEINFORMATIONREMOVED>/MyDocuments, File/Folder: Folder, Size: NA, User: <PRIVATEINFORMATIONREMOVED>, IP: 10.0.0.235
Event: create, Path: /projects/<PRIVATEINFORMATIONREMOVED>/MyDocuments/SuiteCRMTempAttachmentPath, File/Folder: Folder, Size: NA, User: <PRIVATEINFORMATIONREMOVED>, IP: 10.0.0.235
Event: create, Path: /projects/<PRIVATEINFORMATIONREMOVED>/MyDocuments/SuiteCRMTempAttachmentPath/<PRIVATEINFORMATIONREMOVED>.pdf, File/Folder: File, Size: 0 Bytes, User: <PRIVATEINFORMATIONREMOVED>, IP: 10.0.0.235
Event: write, Path: /projects/<PRIVATEINFORMATIONREMOVED>/MyDocuments/SuiteCRMTempAttachmentPath/4390EE7E.tmp, File/Folder: File, Size: 102.31 KB, User: <PRIVATEINFORMATIONREMOVED>, IP: 10.0.0.235
Event: create, Path: /projects/<PRIVATEINFORMATIONREMOVED>/MyDocuments/SuiteCRMTempAttachmentPath/4390EE7E.tmp, File/Folder: File, Size: 0 Bytes, User: <PRIVATEINFORMATIONREMOVED>, IP: 10.0.0.235
Event: read, Path: /projects/<PRIVATEINFORMATIONREMOVED>/MyDocuments/SuiteCRMTempAttachmentPath/4390EE7E.tmp, File/Folder: File, Size: 102.31 KB, User: <PRIVATEINFORMATIONREMOVED>, IP: 10.0.0.235
Event: create, Path: /projects/<PRIVATEINFORMATIONREMOVED>/MyDocuments/SuiteCRMTempAttachmentPath/4390EE7E.tmp, File/Folder: File, Size: 0 Bytes, User: <PRIVATEINFORMATIONREMOVED>, IP: 10.0.0.235
Event: read, Path: /projects/<PRIVATEINFORMATIONREMOVED>/MyDocuments/SuiteCRMTempAttachmentPath/4390EE7E.tmp, File/Folder: File, Size: 102.31 KB, User: <PRIVATEINFORMATIONREMOVED>, IP: 10.0.0.235
Event: move, Path: /projects/<PRIVATEINFORMATIONREMOVED>/MyDocuments/SuiteCRMTempAttachmentPath/77B05067.tmp -> /projects/#recycle/<PRIVATEINFORMATIONREMOVED>/MyDocuments/SuiteCRMTempAttachmentPath/77B05067.tmp, File/Folder: File, Size: 0 Bytes, User: <PRIVATEINFORMATIONREMOVED>, IP: 10.0.0.235
ent: rename, Path: /projects/<PRIVATEINFORMATIONREMOVED>/MyDocuments/SuiteCRMTempAttachmentPath/<PRIVATEINFORMATIONREMOVED>.pdf -> /projects/<PRIVATEINFORMATIONREMOVED>/MyDocuments/SuiteCRMTempAttachmentPath/77B05067.tmp, File/Folder: File, Size: 0 Bytes, User: <PRIVATEINFORMATIONREMOVED>, IP: 10.0.0.235
Event: rename, Path: /projects/<PRIVATEINFORMATIONREMOVED>/MyDocuments/SuiteCRMTempAttachmentPath/4390EE7E.tmp -> /projects/<PRIVATEINFORMATIONREMOVED>/MyDocuments/SuiteCRMTempAttachmentPath/<PRIVATEINFORMATIONREMOVED>.pdf, File/Folder: File, Size: 102.31 KB, User: <PRIVATEINFORMATIONREMOVED>, IP: 10.0.0.235
Event: read, Path: /projects/<PRIVATEINFORMATIONREMOVED>/MyDocuments/SuiteCRMTempAttachmentPath/<PRIVATEINFORMATIONREMOVED>.pdf, File/Folder: File, Size: 102.31 KB, User: <PRIVATEINFORMATIONREMOVED>, IP: 10.0.0.235
Event: read, Path: /projects/<PRIVATEINFORMATIONREMOVED>/MyDocuments/SuiteCRMTempAttachmentPath/<PRIVATEINFORMATIONREMOVED>.pdf, File/Folder: File, Size: 102.31 KB, User: <PRIVATEINFORMATIONREMOVED>, IP: 10.0.0.235
Event: move, Path: /projects/<PRIVATEINFORMATIONREMOVED>/MyDocuments/SuiteCRMTempAttachmentPath/<PRIVATEINFORMATIONREMOVED>.pdf -> /projects/#recycle/<PRIVATEINFORMATIONREMOVED>/MyDocuments/SuiteCRMTempAttachmentPath/<PRIVATEINFORMATIONREMOVED>.pdf, File/Folder: File, Size: 102.31 KB, User: <PRIVATEINFORMATIONREMOVED>, IP: 10.0.0.235
Event: delete, Path: /projects/<PRIVATEINFORMATIONREMOVED>/MyDocuments/SuiteCRMTempAttachmentPath, File/Folder: Folder, Size: NA, User: <PRIVATEINFORMATIONREMOVED>, IP: 10.0.0.235
Event: read, Path: /projects/<PRIVATEINFORMATIONREMOVED>/MyDocuments/SuiteCRMTempAttachmentPath/<PRIVATEINFORMATIONREMOVED>.pdf, File/Folder: File, Size: 102.31 KB, User: <PRIVATEINFORMATIONREMOVED>, IP: 10.0.0.235