Need to find out who deleted files

[Arch1tect]

Let me preface with the fact that I am not a true HP-UX admin.

Came in this morning to discover that someone (or something) had deleted all of the binaries for a production environment here at the office.

We were able to restore them, but we cannot determine who removed them. So far, I have checked the syslog.log, and each users .sh_history and I have found nothing. Is there another way I can find this info?

Thanks in advance!

Phil

[John Dvorchak · Accepted solution]

I think the best you can do is look issue the last command and see who was logged on at that time. Hopefully that will narrow the list of suspects. If you don't know about when it happened you can look at the directory, if it still exists, for the last modification time.

[Torsten.]

Normally the file owner and root only are able to delete the files. I guess not so many people can have root access to your server.

[Pete Randall]

If permissions were set correctly it would have taken someone with root authority to remove the files. Someone in that position who was bent on being so disruptive/destructive would most likely plan on coverning their tracks by editing .sh_history and syslog as well.

I would first take a look at who has root access, starting by changing the password and making sure that only those who truly need to have root access know the new password.


Pete

[Arch1tect]

Thanks for the help. I was able to figure it out using "last" and some further investigation.

[John Dvorchak]

You are welcome and welcome to the forums. I see that you are new to the HP ITRC forums and I want to remind you to assign points for correct/helpful answers. That way some one in the future can search for a similar problem and seeing points assigned knows that it was helpful.

Please don't assign points for this response.
Good luck!

[Ivan Ferreira]

The last command may not help too much, if there where a lot of users loging at that time, or no users logged in at that time.

You may check also the /home//.sh_history if there is an rm command that deleted your file.

For the future, you may need to enable auditing.