logs of userdel

[skt_skt]

Red Hat Enterprise Linux AS release 3 (Taroon Update 9)
Red Hat Enterprise Linux AS release 4 (Nahant Update 6)

I have a couple of systems where a particular user got deleted. So far not trace was found how the id is deleted(locally or remotly??)

is there a log in OS level which tracks those? Or which safe software/tool can do that

[Ivan Ferreira · Accepted solution]

The log file is /var/log/secure. But this file is rotated, so, you have to search in old files also.

[Basheer_2]

Also check the history files if they are set.

for ex: .sh_history in the users home dir.

[mohamed.bouraoui]

Dear friend,
now you have one solution to detect who do it, is to execute the command : history
the output of this command is to list all command did it , so you can log all what the user use if you install snoopy opensource,
it's very usefull for you. but I think that works only in redhat 3, I didn't try it in redhat 4.
good luck