System Administration
cancel
Showing results for 
Search instead for 
Did you mean: 

how can i know who delete files in red hat

Edwin Ruiz1
Occasional Contributor

how can i know who delete files in red hat

Hi!
Somebody delete some files in one of our linux redhat servers. how can i know who deletes this files? in hp-ux i can see it in /var/adm/syslog/syslog.log. Is there some log similar in Redhat Linux.

Thx for ur help
2 REPLIES
Ivan Ferreira
Honored Contributor

Re: how can i know who delete files in red hat

You need to configure auditing, please see:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1041575
Por que hacerlo dificil si es posible hacerlo facil? - Why do it the hard way, when you can do it the easy way?
skt_skt
Honored Contributor

Re: how can i know who delete files in red hat

but make sure that you keep an eye on your /var file system. Logs are created under /var/log/audit.d.

There is a threshold defined in audit configuration file (/etc/audit/audit.conf) and by default server wont respond to any further system calls further and will be in hung state till the server is rebooted.

man auditd