How do you audit which user id delete files in CMS server?

[247star]

Hi,

Our CMS server unable to accept any connection, because someone deleted files below:
/export/home/cms
RUNC local.cshrc local.login local.profile multiKO_exempt
I have to restored them from back. How do I find the user id that deleted these files in Solaris Unix?

 

[PeteBull]

this probably varies with version numbers.

On my CMS 12 system, I can see what each user did by:

cd /export/home/{username}
more .sh_history

one caveat - if the user was su - (root) then you won't be able to tell who did it as root because the command history will be in root's history file.

 

[247star]

I'm on CMS 14 system. I can't do more .sh_history. file doesn't exist.

 

[AvayaTier3]

filename may have changed to .bash_history

Use "ls -al /export/home/cms" to see hidden filenames that begin with "."

If you are using the login that you want to check
"set | grep HIST" will show you where your history is stored.

A great teacher, does not provide answers, but methods to teach others "How and where to find the answers"

bsh

35 years Bell, AT&T, Lucent, Avaya
Tier 3 for 25 years and counting

http://bshtele.com