Deleted file

[Will McDonald]

On 24/08/05, Meadows, Andrew <AMeadows at bmi.com> wrote:
> Is there a log file I can look to to see who deleted a file?
> Have looked at bash_history and there is nothing there....
> Running AS V3 R4

Not as far as I'm aware, no. However, have you checked all user's
.bash_history files?

# slocate .bash_history | xargs grep rm

.bash_history's by no means a guaranteed mechanism though. If you need
to monitor your user's usage that closely then some of these might
help...

http://honeypots.sourceforge.net/modified_script.html

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=947033

http://sourceforge.net/projects/rootsh/

http://software.mutant.net/ppod.html

Will.