Trace for a folder deletion

[MoshiachNow]

Hi,

We have folders/files dissapearing randomnly.
The server volumes are mounted via NFS to other Unix machines.
Any idea on how to setup a trace that will gather the system info ONLY for a folder/file deletion events ?

"Long live king Moshiach !"

http://www.7for70.com/14 index.html

 

[mkharris]

You have a number of options here. You could write a logging wrapper for rm / rmdir ( i.e. a script that encapsulates a command you are disguising, rather than Eminem performing on a tree trunk ).

If your accounting system is set up, then lastcomm might help.

Alternatively, a regular search through .sh_history for each user?

 

[KenCunningham]

"( i.e. a script that encapsulates a command you are disguising, rather than Eminem performing on a tree trunk )."

LOL here boss!

 

[MoshiachNow]

Thanks,

But unfortunately I have to trace the deletion that is probably done not by "rm" ,but by c++ application.

We have Macintoshes and Unix systems mounting those volumes - so the best I can look for in the trace is some "unlink" event.

Anybody has got experience with such a mission ? "Long live king Moshiach !"

http://www.7for70.com/14 index.html

 

[gheist]

do you feel file deletions incorrect? I think they are appropriate as you allowed people to remove files. Check if permissions arent too loose on your directories (ie +w on staff group or o+w) and set minimal umask for users, check if your nfs isnt running in root-for-world mode
Yes "trace" is common tool for tracing system calls for statistic purposes.