accounting? deleted file

[robert70]

can you find out when & who deleted a file on your VMS system?
A file was deleted on our system yesterday and we are trying to find out which user was responsible?
can you use accounting for this?
thanks

[Ian Miller.]

Depending on your configuration then the audit log may be the place. I would not expect to find this in auditing.

Quizzing the people is probably your best way forward.

[robert70]

the audit log dosent have any event_type=delete so cant get info from that

[Hoff · Accepted solution]

$ show audit
$ set audit /alar /enable=access=success=delete

For details:

$ HELP SHOW AUDIT
$ HELP SET AUDIT /ENABLE

The audit log catches delete operations via the ACCESS=SUCCESS=DELETE knob, if that setting was enabled prior to the deletion.

The setting is not AFAIK enabled by default.

Which likely means no, there is no VMS record of the deletion. But it does mean that you can catch deletions.

[robert70]

thanks Hoff
we have enabled that now for future

[tsgdavid]

Just a thought...

If you know the time frame when the file was deleted, you could determine via ASCCOUNTING which users were logged in at the time (don't forget about users who are still logged in). Also if a user deleted the file and is still logged in on the system, you can examine the command recall buffer for a user who may be a suspect. If the command recall buffer has not been overwritten, you may find the DELETE command there.

Of course, if you find the culprit, be careful about implicating a specific person when in reality, you only know what user account was used. You may need to do additional work to implicate a specific person. (The voice of experience)

[John McL]

Was it a large file and do you have any performance monitoring tools?

If the answer is "yes" to both then it might be possible to examine free space on the disk across the day and find any sudden increases in free space that would correspond to the file size. The same tool should be able to tell you what processes (and therefore what users) were active on the system at the time.

[Barry Alford]

Just a trick from my VMS Book Of Trivia:

You can delete (the latest version of) a file without using the Delete command, or specifying the version(s), by using

$ PRINT/DELETE

I don't know if Auditing would pick this up!!

[robert70]

thanks for all your help
much appreciated