how to check which id has been deleted of moved some files from HP ux 11.00 machind

[Harikrishnan L]

how to check which id has been deleted of moved some files from HP ux 11.00 machind

[Dennis Handly]

>how to check which id has

If you want to check which user fiddled with files, you need to turn on auditing.

You may or not be able to look in their shell history files.

[Harikrishnan L]

Thanks,

can you give me any command for example

[Dennis Handly]

>can you give me any command for example

Like "more /home/*/.sh_history*"?

To enable auditing you may have to convert you system to trusted, then enable auditing and this only works for the next time this happens.

[Suraj K Sankari]

Hi,

>>how to check which id has been deleted of moved some files from HP ux 11.00 machind

you can check this file .sh_history which is residing /home/users/.sh_history

Or you can enable auditing

Suraj

[Harikrishnan L]

Thanks,

The given command has listed only the what are the command has been used, is there any other commad to display the userid, date and time for that command used.

Thanks
Hari

[Dennis Handly]

>is there any other command to display the userid, date and time for that command used

No, that requires auditing or some third party product.