Operating System - OpenVMS
cancel
Showing results for 
Search instead for 
Did you mean: 

accounting? deleted file

 
SOLVED
Go to solution
robert70
Valued Contributor

accounting? deleted file

can you find out when & who deleted a file on your VMS system?
A file was deleted on our system yesterday and we are trying to find out which user was responsible?
can you use accounting for this?
thanks
8 REPLIES 8
Ian Miller.
Honored Contributor

Re: accounting? deleted file

Depending on your configuration then the audit log may be the place. I would not expect to find this in auditing.

Quizzing the people is probably your best way forward.
____________________
Purely Personal Opinion
robert70
Valued Contributor

Re: accounting? deleted file

the audit log dosent have any event_type=delete so cant get info from that
Hoff
Honored Contributor
Solution

Re: accounting? deleted file

$ show audit
$ set audit /alar /enable=access=success=delete

For details:

$ HELP SHOW AUDIT
$ HELP SET AUDIT /ENABLE

The audit log catches delete operations via the ACCESS=SUCCESS=DELETE knob, if that setting was enabled prior to the deletion.

The setting is not AFAIK enabled by default.

Which likely means no, there is no VMS record of the deletion. But it does mean that you can catch deletions.
robert70
Valued Contributor

Re: accounting? deleted file

thanks Hoff
we have enabled that now for future
tsgdavid
Frequent Advisor

Re: accounting? deleted file

Just a thought...

If you know the time frame when the file was deleted, you could determine via ASCCOUNTING which users were logged in at the time (don't forget about users who are still logged in). Also if a user deleted the file and is still logged in on the system, you can examine the command recall buffer for a user who may be a suspect. If the command recall buffer has not been overwritten, you may find the DELETE command there.

Of course, if you find the culprit, be careful about implicating a specific person when in reality, you only know what user account was used. You may need to do additional work to implicate a specific person. (The voice of experience)
John McL
Trusted Contributor

Re: accounting? deleted file

Was it a large file and do you have any performance monitoring tools?

If the answer is "yes" to both then it might be possible to examine free space on the disk across the day and find any sudden increases in free space that would correspond to the file size. The same tool should be able to tell you what processes (and therefore what users) were active on the system at the time.
Barry Alford
Frequent Advisor

Re: accounting? deleted file

Just a trick from my VMS Book Of Trivia:

You can delete (the latest version of) a file without using the Delete command, or specifying the version(s), by using

$ PRINT/DELETE

I don't know if Auditing would pick this up!!
robert70
Valued Contributor

Re: accounting? deleted file

thanks for all your help
much appreciated