HPE Community
Operating System - Linux
1751709 Members
4584 Online
108781 Solutions
New Discussion юеВ

how can i know who delete files in red hat

 
Edwin Ruiz1
Occasional Contributor

тАО10-16-2007 03:03 AM

тАО10-16-2007 03:03 AM

how can i know who delete files in red hat

Hi!
Somebody delete some files in one of our linux redhat servers. how can i know who deletes this files? in hp-ux i can see it in /var/adm/syslog/syslog.log. Is there some log similar in Redhat Linux.

Thx for ur help
0 Kudos
Reply
2 REPLIES 2
Ivan Ferreira
Honored Contributor

тАО10-16-2007 03:22 AM

тАО10-16-2007 03:22 AM

Re: how can i know who delete files in red hat

You need to configure auditing, please see:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1041575
Por que hacerlo dificil si es posible hacerlo facil? - Why do it the hard way, when you can do it the easy way?
0 Kudos
Reply
skt_skt
Honored Contributor

тАО10-23-2007 11:25 AM

тАО10-23-2007 11:25 AM

Re: how can i know who delete files in red hat

but make sure that you keep an eye on your /var file system. Logs are created under /var/log/audit.d.

There is a threshold defined in audit configuration file (/etc/audit/audit.conf) and by default server wont respond to any further system calls further and will be in hung state till the server is rebooted.

man auditd
0 Kudos
Reply
The opinions expressed above are the personal opinions of the authors, not of Hewlett Packard Enterprise. By using this site, you accept the Terms of Use and Rules of Participation.