cancel
Showing results for 
Search instead for 
Did you mean: 

logs of userdel

 
SOLVED
Go to solution
Highlighted
Honored Contributor

logs of userdel

Red Hat Enterprise Linux AS release 3 (Taroon Update 9)
Red Hat Enterprise Linux AS release 4 (Nahant Update 6)

I have a couple of systems where a particular user got deleted. So far not trace was found how the id is deleted(locally or remotly??)

is there a log in OS level which tracks those? Or which safe software/tool can do that
3 REPLIES 3
Highlighted
Honored Contributor
Solution

Re: logs of userdel

The log file is /var/log/secure. But this file is rotated, so, you have to search in old files also.
Por que hacerlo dificil si es posible hacerlo facil? - Why do it the hard way, when you can do it the easy way?
Highlighted
Trusted Contributor

Re: logs of userdel

Also check the history files if they are set.

for ex: .sh_history in the users home dir.
Highlighted
Frequent Advisor

Re: logs of userdel

Dear friend,
now you have one solution to detect who do it, is to execute the command : history
the output of this command is to list all command did it , so you can log all what the user use if you install snoopy opensource,
it's very usefull for you. but I think that works only in redhat 3, I didn't try it in redhat 4.
good luck