rm command to remove dir, how do I check who run that?

[AIXdream]

Hello Guys,

I was working on an issue and found 2 directories were removed by user with rm command on Linux, anyone any idea how do we find who run rm on the server? This caused application and business outage. I Checked /root/.bash_history and found the command rm was executed on 2 log directories under /logs. But that doesnt tell whole story, who did.

Any help is appreciated.

 

[thedaver]

Uhhhh 'root' did it!

Now "who" was root is apparently your interest?

Use 'last'
Check your /var/log/secure (or similar) for attempts to issue "sudo" or "su" commands...

Keep in mind you're either looking for a sloppy/malicious known user or a cracker.

D.E.R. Management - IT Project Management Consulting

http://www.dermanagement.com/