auditing file deletions

[normntwrk]

I'd like to know if there is any way to tell if someone deletes a file by FTP, command line deletion , Samba share deletion etc.

I've set up auditing but it doesn't seem very helpful

thanks
Norm

 

[mrn]

tripwire should do the job.

Mike

"Whenever I dwell for any length of time on my own shortcomings, they gradually begin to seem mild, harmless, rather engaging little things, not at all like the staring defects in other people's characters."

 

[normntwrk]

Any idea where there might be an open source version compiled for AIX ?

Thanks
Norm

 

[blarneyme]

[URL unfurl="true"]http://www.ibm.com/developerworks/aix/library/au-usingtripwire/[/URL]

 

[DukeSSD]

IIRC you have to make most of the rules in AIX auditing, did you bother to make a delete rule that would cover all the things you want?

 

[normntwrk]

I haven't found any directions to do that. I'd be glad to if I had clear information in how to do that

Norm

 

[normntwrk]

I can capture the file deletions if it is done at the command line just fine, I can't capture it with AIX auditing if deleted with FTP or from a SAMBA session (we use facetwin which is like SAMBA)