Hi guys !
Suddenly my alreadu installed applicatin isn´t running any more, checking the entire system the folder where my application ussualy runs isn´t there!, somebody has to delete it!, is possible to know which user did it?..., i am not going to hill him...i promess !

or
if you are using sudo access

I have done these checks:

1. Check for /var/log/secure for abnormal access, nothing extrange...
2. Check for suspect deletion user history entries.... no rm or mv commanns ..no registry holes
3. Check for .bash_history, same, no rm, or mv commands
4. Check for audit.log for strange files access, nothing wrong

Any additional idea ?

Please write and spell clearly.

And it would help if you provided some actual DETAILS...things like version/distro of Linux, what "application" you're talking about, how it was installed, what environment, etc. All you've told us is "something got deleted".

And since you're not going to 'hill him' (assuming you mean "kill"), check all the .bash_history files for all your users. Also check the .bash_history for root. If you see it in root's history, then look at the logs, to see who logged in as root, from where. And what do you mean by "registry holes", since Linux doesn't HAVE a registry?

How To Investigate A Linux Compromise
http://forums.theplanet.com/index.php?showtopic=59486