find which user deleted particular folder that has full permission rwx to all users!!
 

how to find whether directory deleted is deleted by particular user???
i am using for testing purpose...
I have tested inotifywait tool but this doesnt find which user has deleted the folder or modified something...
i am using RHEL 6.0
any tool or technique!!!!

the tedious way would be to check the history of each user.

I'm pretty sure systemtap can do that http://www.linuxtopia.org/online_boo...ide/index.html

I've used DTrace on Solaris for the same thing.