I want to track files that are deleted on my Ubuntu Server in a log file or a database. So if a file is deleted, I will know by who and when it was deleted.
How can I do that?
You want auditd system (sudo apt-get install auditd). Something like this I think should enable deletion tracking for all files:
auditctl -a exit,always -F arch=b32 -S unlink -S unlinkat -S rmdir -k deletion
I believe the logs should be showing up in /var/log/audit.
To learn more:
man auditctl
man audit.rules