how to trace a command

[Brian Lee_4]

one of unix users deleted one directory.
Unfortunately, the user doesn't have ~/.sh_history file so that I can not trace who deleted the directory.

Does anyone know how to trace a command run by a specific user ?

[Michael Tully]

Unless the user has a .sh_history or equivalent, (depending on the type of shell) the answer is no, unless you run system auditing, which is probably unlikely.

[Michael Schulte zur Sur]

Hi,

is that for future purposes or for this incident?

greetings,

Michael

[Sanjay_6]

Hi,

You cannot trace a command unless it is stored in the history. Had this been a system related command, you could have tried syslog.log where it logs some systems command.

Hope this helps.

Regds