System Administration
cancel
Showing results for 
Search instead for 
Did you mean: 

how to know who/when file deleted in HP-UX

 
korgo01
Occasional Contributor

how to know who/when file deleted in HP-UX

some one deleted one file in HP-UX. i want to find the logs like who deleted and when the file got deleted. even i verified syslog.log . it not showing any thing. please help me in this regard.
Thanks
krishna
7 REPLIES
James R. Ferguson
Acclaimed Contributor

Re: how to know who/when file deleted in HP-UX

Hi:

Sorry, unless you can find a tell-tell command in a shell history, you are out-of-luck. Unix does exactly what it is told to do and silently unless it has something to say!

Regards!

...JRF...
Ganesan R
Honored Contributor

Re: how to know who/when file deleted in HP-UX

Hi,

Try with history file. you may get something with "history" command.
Best wishes,

Ganesh.
Mark McDonald_2
Trusted Contributor

Re: how to know who/when file deleted in HP-UX

Do you have a daily backup to give you an idea when it was deleted? if so who was logged in at that time?
Mark McDonald_2
Trusted Contributor

Re: how to know who/when file deleted in HP-UX

Sorry to post twice.

What were the permissions on the file? That could give you an idea who had privileges to delete it.
Analyst
Trusted Contributor

Re: how to know who/when file deleted in HP-UX

Hi,

There is one option, for which the system should be in trusted mode and auditing should enabled.

By which we can find out the each and all the activity carried out by users.

Thx,
Analyst.
Suraj K Sankari
Honored Contributor

Re: how to know who/when file deleted in HP-UX

Hi,

If you configure auditing into you server then i think you can trace who/when delete, which file from the logs.

One more thing you can find .sh_history file into every login's home directory there you need to check with cat but you can't trace the time over there.



Suraj
Steven E. Protter
Exalted Contributor

Re: how to know who/when file deleted in HP-UX

Shalom,

For the future if you had audit logs enabled, a feature of trusted systems you might be able to find this data.

Trsusted system is however declared obsolete. There is an alternative for 11.31 HP-UX and the future.

SEP
Steven E Protter
Owner of ISN Corporation
http://isnamerica.com
http://hpuxconsulting.com
Sponsor: http://hpux.ws
Twitter: http://twitter.com/hpuxlinux
Founder http://newdatacloud.com