Hi, Cameron, Thanks for your prompt response. I still has problem, please help. I go to /usr/log, only found wtmp.1, and I could not use vi to see it, what should I need to do next? if the files deleted by someone who made mistake, can I get it back ? Thanks. Regards, Jason Zeng Cameron Simpson <cs@zip.com.au> wrote:<blockquote class="replbq" style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; padding-left: 5px;"> On 21Jan2007 18:32, jason zeng <jason388600@yahoo.ca> wrote: | I am not familiar with RedHat Linux logs, and I am encountering a problem | that our important files disappeared. So I want to know WHO made this? How | can I get info about who login and when, Could I find a way to recover the | files? it is possible? The wtmp file is the traditional place. The "last" command lists recent logins for you. -- Cameron Simpson <cs@zip.com.au> DoD#743 http://www.cskk.ezoshosting.com/cs/ Printer not ready. Could be a fatal error. Have a pen handy? - Haiku Error Messages http://www.salonmagazine.com/21st/chal/1998/02/10chal2.html _______________________________________________ Redhat-install-list mailing list Redhat-install-list@redhat.com https://www.redhat.com/mailman/listinfo/redhat-install-list To Unsubscribe Go To ABOVE URL or send a message to: redhat-install-list-request@redhat.com Subject: unsubscribe </cs@zip.com.au></jason388600@yahoo.ca></blockquote> <hr size=1>Be smarter than spam. See how smart SpamGuard is at giving junk email the boot with the <a href="http://us.rd.yahoo.com/evt=40705/*http://mrd.mail.yahoo.com/try_beta?.intl=ca">All-new Yahoo! Mail </a>