Delete Logs

Hello,
I am curious if anyone has any information on something that would be able to help me determine who deleted a certain file on a linux box? I know this question might be rather elementary, but I have not been able to come up with anything searching the WWW. I don't know if there is a log that keeps track of these things or what, so any help in the right direction is much appreciated.

-onelung

You can take a look at your users's .bash_history, assuming they use bash:

cd /home
find `ls`/.bash_history -exec /usr/bin/grep "deleted-filename" {} /dev/null \;

If it's a file that only root can delete then look at root's .bash_history, but then you have to find out who was logged as root or su'ed to root. For this the command "last root|more" could help you

Of course, if you are not defaulting to bash then you need to:

cd /home
vi .sh_history
/[deleted_file]

if you find the command entry that deleted the file, scroll back a few and see if you can tell who.

Additionally, if you don't know the date it was deleted, request a restore from a previous date noting when it first becomes available for restore.

Hi,

can I know how to check if any one deleted history command by history -c & .bash_history file.