Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations strongm on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

How do you audit which user id delete files in CMS server?

Status
Not open for further replies.

247star

MIS
Nov 28, 2008
14
US
Hi,

Our CMS server unable to accept any connection, because someone deleted files below:
/export/home/cms
RUNC local.cshrc local.login local.profile multiKO_exempt
I have to restored them from back. How do I find the user id that deleted these files in Solaris Unix?
 
this probably varies with version numbers.

On my CMS 12 system, I can see what each user did by:

cd /export/home/{username}
more .sh_history

one caveat - if the user was su - (root) then you won't be able to tell who did it as root because the command history will be in root's history file.

 
I'm on CMS 14 system. I can't do more .sh_history. file doesn't exist.
 
filename may have changed to .bash_history

Use "ls -al /export/home/cms" to see hidden filenames that begin with "."

If you are using the login that you want to check
"set | grep HIST" will show you where your history is stored.

A great teacher, does not provide answers, but methods to teach others "How and where to find the answers"

bsh

35 years Bell, AT&T, Lucent, Avaya
Tier 3 for 25 years and counting
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top