how to know who/when file deleted in HP-UX

[korgo01]

some one deleted one file in HP-UX. i want to find the logs like who deleted and when the file got deleted. even i verified syslog.log . it not showing any thing. please help me in this regard.
Thanks
krishna

[James R. Ferguson]

Hi:

Sorry, unless you can find a tell-tell command in a shell history, you are out-of-luck. Unix does exactly what it is told to do and silently unless it has something to say!

Regards!

...JRF...

[Ganesan R]

Hi,

Try with history file. you may get something with "history" command.

[Mark McDonald_2]

Do you have a daily backup to give you an idea when it was deleted? if so who was logged in at that time?

[Mark McDonald_2]

Sorry to post twice.

What were the permissions on the file? That could give you an idea who had privileges to delete it.

[Analyst]

Hi,

There is one option, for which the system should be in trusted mode and auditing should enabled.

By which we can find out the each and all the activity carried out by users.

Thx,
Analyst.

[Suraj K Sankari]

Hi,

If you configure auditing into you server then i think you can trace who/when delete, which file from the logs.

One more thing you can find .sh_history file into every login's home directory there you need to check with cat but you can't trace the time over there.



Suraj

[Steven E. Protter]

Shalom,

For the future if you had audit logs enabled, a feature of trusted systems you might be able to find this data.

Trsusted system is however declared obsolete. There is an alternative for 11.31 HP-UX and the future.

SEP