Hello guys.
i wonder is there any way to find out the audit history about files or folders in red hat?
for example if i change the folder name how can find the privies folder name?
or if i change the files content can i restore it?
Thank you.

Generally speaking Linux distributions do not come with a perfect audit trail configured and enabled out of the box by default. So until you configure it (audit service, rootsh, etc, etc) there'll be only inode meta data (see 'man stat'), users shell history (if any), BSD Accounting ('acct'), login records ('lastb; last') or application "recent files" functionality (if any), none of which should be taken as all-encompassing or tamperproof in the event of a compromise of security unless combined with remote logging.


If you changed the name from a shell then look at your shell history.


Not if you haven't made any backups prior to making changes. There's one exception and that is files contained in a package: you can verify package contents, download the package then extract and 'diff' files or replace it with a pristine copy.

1 members found this post helpful.