- Community Home
- >
- Servers and Operating Systems
- >
- Operating Systems
- >
- Operating System - HP-UX
- >
- Re: can we know who deleted a particular file. & i...
Categories
Company
Local Language
Forums
Discussions
Forums
- Data Protection and Retention
- Entry Storage Systems
- Legacy
- Midrange and Enterprise Storage
- Storage Networking
- HPE Nimble Storage
Discussions
Discussions
Discussions
Forums
Forums
Discussions
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
- BladeSystem Infrastructure and Application Solutions
- Appliance Servers
- Alpha Servers
- BackOffice Products
- Internet Products
- HPE 9000 and HPE e3000 Servers
- Networking
- Netservers
- Secure OS Software for Linux
- Server Management (Insight Manager 7)
- Windows Server 2003
- Operating System - Tru64 Unix
- ProLiant Deployment and Provisioning
- Linux-Based Community / Regional
- Microsoft System Center Integration
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Community
Resources
Forums
Blogs
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО05-16-2011 07:02 AM
тАО05-16-2011 07:02 AM
can we know who deleted a particular file. & is there any process to get back that file.
can we know who deleted a particular file in HPUX.
and is there any process to get back that file.
any other way to restrict file deletion except setuid,setgid & setid
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО05-16-2011 07:08 AM
тАО05-16-2011 07:08 AM
Re: can we know who deleted a particular file. & is there any process to get back that file.
Hope this helps!
Regards
Torsten.
__________________________________________________
There are only 10 types of people in the world -
those who understand binary, and those who don't.
__________________________________________________
No support by private messages. Please ask the forum!
If you feel this was helpful please click the KUDOS! thumb below!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО05-16-2011 08:13 AM
тАО05-16-2011 08:13 AM
Re: can we know who deleted a particular file. & is there any process to get back that file.
And as Torsten said, there is no undelete in any form of stock unix installation, including hpux. If you lost a file by accident, cross your fingers and pray that you have a recently backed up copy on tape somewhere. Otherwise, you're out of luck.
UNIX because I majored in cryptology...
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО05-16-2011 08:18 AM
тАО05-16-2011 08:18 AM
Re: can we know who deleted a particular file. & is there any process to get back that file.
Some OS are getting to the point where it ~might~ be possible to roll backwards and "see" previous versions of files, but not HPUX.
The only defense you have against this sort of thing is solid backup strategy.
If you had a server somewhere setup to mirror your FS's via something like rsync and you had built in a delay, you might be able to catch this and stop the sync process before the users actions were duplicated, thus saving the file(s). Even that would be a timing issue and you'd need some luck to be successful.
As for finding who deleted the file... not really possible, but you may have some luck by looking through shell history files system wide and searching for the file name and/or the name of the directory where the file lived.
DIR="name of directory"
FILE="name of file"
Hth,
-klb
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО05-16-2011 08:33 AM
тАО05-16-2011 08:33 AM
Re: can we know who deleted a particular file. & is there any process to get back that file.
UNIX because I majored in cryptology...
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО05-16-2011 08:44 AM
тАО05-16-2011 08:44 AM
Re: can we know who deleted a particular file. & is there any process to get back that file.
> any other way to restrict file deletion except setuid,setgid & setid
A directory determines the file's fate. That is, if you have write permissions to the *directory* then you can delete entities within the directory.
The 'setuid' bit is not going to do anything. If you have the 'setgid' bit set on the file's directory, some additonal protection is provided insofar as only the owner of a file can delete it.
Of course, if it's the root user doing the removal, then you are out-of-luck.
By design, Unix does what it is told to do without fuss. If you delete a file you better have a backup if you later decide you want it.
Regards!
...JRF...