topic Re: accounting? deleted file in Operating System - OpenVMS

accounting? deleted file

robert70 — Thu, 19 Aug 2010 08:45:42 GMT

can you find out when & who deleted a file on your VMS system?
A file was deleted on our system yesterday and we are trying to find out which user was responsible?
can you use accounting for this?
thanks

Re: accounting? deleted file

Ian Miller. — Thu, 19 Aug 2010 09:05:56 GMT

Depending on your configuration then the audit log may be the place. I would not expect to find this in auditing.

Quizzing the people is probably your best way forward.

Re: accounting? deleted file

robert70 — Thu, 19 Aug 2010 12:21:04 GMT

the audit log dosent have any event_type=delete so cant get info from that

Re: accounting? deleted file

Hoff — Thu, 19 Aug 2010 14:23:58 GMT

$ show audit
$ set audit /alar /enable=access=success=delete

For details:

$ HELP SHOW AUDIT
$ HELP SET AUDIT /ENABLE

The audit log catches delete operations via the ACCESS=SUCCESS=DELETE knob, if that setting was enabled prior to the deletion.

The setting is not AFAIK enabled by default.

Which likely means no, there is no VMS record of the deletion. But it does mean that you can catch deletions.

Re: accounting? deleted file

robert70 — Thu, 19 Aug 2010 15:28:47 GMT

thanks Hoff
we have enabled that now for future

Re: accounting? deleted file

tsgdavid — Mon, 30 Aug 2010 12:18:12 GMT

Just a thought...

If you know the time frame when the file was deleted, you could determine via ASCCOUNTING which users were logged in at the time (don't forget about users who are still logged in). Also if a user deleted the file and is still logged in on the system, you can examine the command recall buffer for a user who may be a suspect. If the command recall buffer has not been overwritten, you may find the DELETE command there.

Of course, if you find the culprit, be careful about implicating a specific person when in reality, you only know what user account was used. You may need to do additional work to implicate a specific person. (The voice of experience)

Re: accounting? deleted file

John McL — Tue, 31 Aug 2010 00:21:16 GMT

Was it a large file and do you have any performance monitoring tools?

If the answer is "yes" to both then it might be possible to examine free space on the disk across the day and find any sudden increases in free space that would correspond to the file size. The same tool should be able to tell you what processes (and therefore what users) were active on the system at the time.

Re: accounting? deleted file

Barry Alford — Tue, 31 Aug 2010 07:17:57 GMT

Just a trick from my VMS Book Of Trivia:

You can delete (the latest version of) a file without using the Delete command, or specifying the version(s), by using

$ PRINT/DELETE

I don't know if Auditing would pick this up!!

Re: accounting? deleted file

robert70 — Tue, 31 Aug 2010 07:19:17 GMT

thanks for all your help
much appreciated