System Administration
cancel
Showing results for 
Search instead for 
Did you mean: 

how to check which id has been deleted of moved some files from HP ux 11.00 machind

 
Harikrishnan L
Frequent Advisor

how to check which id has been deleted of moved some files from HP ux 11.00 machind

how to check which id has been deleted of moved some files from HP ux 11.00 machind
6 REPLIES
Dennis Handly
Acclaimed Contributor

Re: how to check which id has been deleted of moved some files from HP ux 11.00 machind

>how to check which id has

If you want to check which user fiddled with files, you need to turn on auditing.

You may or not be able to look in their shell history files.
Harikrishnan L
Frequent Advisor

Re: how to check which id has been deleted of moved some files from HP ux 11.00 machind

Thanks,

can you give me any command for example
Dennis Handly
Acclaimed Contributor

Re: how to check which id has been deleted of moved some files from HP ux 11.00 machind

>can you give me any command for example

Like "more /home/*/.sh_history*"?

To enable auditing you may have to convert you system to trusted, then enable auditing and this only works for the next time this happens.
Suraj K Sankari
Honored Contributor

Re: how to check which id has been deleted of moved some files from HP ux 11.00 machind

Hi,

>>how to check which id has been deleted of moved some files from HP ux 11.00 machind

you can check this file .sh_history which is residing /home/users/.sh_history

Or you can enable auditing

Suraj
Harikrishnan L
Frequent Advisor

Re: how to check which id has been deleted of moved some files from HP ux 11.00 machind

Thanks,

The given command has listed only the what are the command has been used, is there any other commad to display the userid, date and time for that command used.

Thanks
Hari
Dennis Handly
Acclaimed Contributor

Re: how to check which id has been deleted of moved some files from HP ux 11.00 machind

>is there any other command to display the userid, date and time for that command used

No, that requires auditing or some third party product.