- Community Home
- >
- Servers and Operating Systems
- >
- Operating Systems
- >
- Operating System - HP-UX
- >
- Re: Files deleted,need to know who deleted????
Categories
Company
Local Language
Forums
Discussions
Forums
- Data Protection and Retention
- Entry Storage Systems
- Legacy
- Midrange and Enterprise Storage
- Storage Networking
- HPE Nimble Storage
Discussions
Discussions
Discussions
Forums
Forums
Discussions
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
- BladeSystem Infrastructure and Application Solutions
- Appliance Servers
- Alpha Servers
- BackOffice Products
- Internet Products
- HPE 9000 and HPE e3000 Servers
- Networking
- Netservers
- Secure OS Software for Linux
- Server Management (Insight Manager 7)
- Windows Server 2003
- Operating System - Tru64 Unix
- ProLiant Deployment and Provisioning
- Linux-Based Community / Regional
- Microsoft System Center Integration
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Community
Resources
Forums
Blogs
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО05-05-2010 03:00 AM
тАО05-05-2010 03:00 AM
Files deleted,need to know who deleted????
Some files has been deleted on hp-ux box .
I want to know that who is the culprit behind this.
So,need to know from where i start findings that who deleted the file.
Need your support and help on this as always?
and thanks in advance....
Best Regards,
LN
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО05-05-2010 03:07 AM
тАО05-05-2010 03:07 AM
Re: Files deleted,need to know who deleted????
here in example root user deleted the file
May 5 09:24:25 sapbiprd ftpd[20568]: root of 172.16.23.2 [172.16.23.2] deleted /tmp/sapinst_instdir/NW04S/SYSTEM/ORA/DISTRIBUTED/AS-ABAP/PREPARE/sapinst_dev.log
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО05-05-2010 03:17 AM
тАО05-05-2010 03:17 AM
Re: Files deleted,need to know who deleted????
I don't think that's a standard message... you may hve some customisations in place...
LN,
It will be dfficiult if you don't have a tool in place to do this... did you have auditing configured... what's the output of:
audsys
HTH
Duncan
I am an HPE Employee
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО05-05-2010 03:19 AM
тАО05-05-2010 03:19 AM
Re: Files deleted,need to know who deleted????
ho have the right to access the server ???
what abiut the privileges ???
last will show you ho was loged to the server.
i think that will be very difficult to find out ho deleted the files.
mikap
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО05-05-2010 03:21 AM
тАО05-05-2010 03:21 AM
Re: Files deleted,need to know who deleted????
Regards,
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО05-05-2010 03:31 AM
тАО05-05-2010 03:31 AM
Re: Files deleted,need to know who deleted????
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО05-05-2010 03:40 AM
тАО05-05-2010 03:40 AM
Re: Files deleted,need to know who deleted????
maybe you can use a perl script to check who touched your file , check it out:
http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1377980
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО05-05-2010 05:40 AM
тАО05-05-2010 05:40 AM
Re: Files deleted,need to know who deleted????
Try the script and let us know; and from the lesson learnt, give access permission only to those responsible. You can use ACLs (from next time onwards)..Check the CIS Internet Security Standards of HP
HTH
SNS
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО05-05-2010 05:50 AM
тАО05-05-2010 05:50 AM
Re: Files deleted,need to know who deleted????
I would first look at the file's directory permission. If the directory is 777 (-rwxrwxrwx) then that is a huge sysadmin error. Nothing in a 777 directory is safe. If the files are in a properly protected directory such as /etc (which is 555 owned by bin:bin) then only a root user can remove the files. If untrained people know the root password, change it immediately and do not give the root password to anyone that is not properly trained. You can use sudo to restrict people that help with sysadmin tasks.
Bill Hassell, sysadmin
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО05-05-2010 05:51 AM
тАО05-05-2010 05:51 AM
Re: Files deleted,need to know who deleted????
if that file is accessed only by root or non root users.if so
check in syslog who have logged in that particular server.
if they had switched as root user u can find entry in syslog.
check with last -R -5 username to fine the date time and from which ip address one has logged in .
regards
MC