- Community Home
- >
- Servers and Operating Systems
- >
- Operating Systems
- >
- Operating System - HP-UX
- >
- Re: Logs of deleted files
Categories
Company
Local Language
Forums
Discussions
Forums
- Data Protection and Retention
- Entry Storage Systems
- Legacy
- Midrange and Enterprise Storage
- Storage Networking
- HPE Nimble Storage
Discussions
Discussions
Discussions
Forums
Forums
Discussions
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
- BladeSystem Infrastructure and Application Solutions
- Appliance Servers
- Alpha Servers
- BackOffice Products
- Internet Products
- HPE 9000 and HPE e3000 Servers
- Networking
- Netservers
- Secure OS Software for Linux
- Server Management (Insight Manager 7)
- Windows Server 2003
- Operating System - Tru64 Unix
- ProLiant Deployment and Provisioning
- Linux-Based Community / Regional
- Microsoft System Center Integration
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Community
Resources
Forums
Blogs
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО01-05-2009 02:42 PM
тАО01-05-2009 02:42 PM
I want details of who deleted a particular file. Is there any system log which stores the same ??
Is there any way such information can be obtained ??
Regards
Abhik Ray
Solved! Go to Solution.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО01-05-2009 03:09 PM
тАО01-05-2009 03:09 PM
Re: Logs of deleted files
No. You *might* examine the '.sh_history' file(s). File deletion is allowed/disallowed by the permissions (write) of the *dirctory* in which a file resides. A sticky bit on the directory will prohibit everyone but the owner (or root) from removing a file.
Regards!
...JRF...
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО01-05-2009 03:13 PM
тАО01-05-2009 03:13 PM
Re: Logs of deleted files
another alternative would be a "wrapper" script inplace of the standard "rm". you could use that to "roll your own" logs.
something like "powerbroker" (commercial software) might also be of use, but at a cost.
the wrapper should be fairly easily implemented.....
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО01-05-2009 03:22 PM
тАО01-05-2009 03:22 PM
Re: Logs of deleted files
I dont know the exact answer to your questions but.
you can start to check /etc/wtmp, this file keeps a log of who has logged in to your system
It wouldn't hurt to check /var/adm/syslog/syslog.log either
Also check if something in your crontab file is not scheduled to delete files.
Hope this helps.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО01-05-2009 03:36 PM
тАО01-05-2009 03:36 PM
Re: Logs of deleted files
Can you please tell me how (and where) do i check the 'sh_history' files.
I checked /var/adm/syslog/syslog.log but found no info related to deletion of the specific file.
Thanks and regards
Abhik Ray
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО01-05-2009 03:45 PM
тАО01-05-2009 03:45 PM
Solution> Can you please tell me how (and where) do i check the 'sh_history' files.
Assuming that you are using the Posix (default) shell:
# more ~/.sh_history
...where '~' is the HOME directory of any user.
> I checked /var/adm/syslog/syslog.log but found no info related to deletion of the specific file.
You won't as noted originally. Unix does exactly what it is told and silently if there isn't anything worthwhile saying.
Regards!
...JRF...
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО01-05-2009 03:48 PM
тАО01-05-2009 03:48 PM
Re: Logs of deleted files
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО01-05-2009 05:24 PM
тАО01-05-2009 05:24 PM
Re: Logs of deleted files
Right. Either wrappers or auditing.