In RHEL 4, how to find who deleted particular directory or file

dhanju · 09-25-2008, 03:28 AM

Hi All

In linux server (RHEL 4), i am holding the root user, today i found that one important directory is missing from one the user's home location. So, how to find who deleted that?
Is there any command to find that or any log will be avaialable to find that?

Pls, help me out to find who removed the directory

Thanks Advance

-Dhanju

ilikejam · 09-25-2008, 05:37 AM

You could try to grep for the directory name in everyone's ~/.*history , but that won't help you if the directory wasn't deleted from a shell.
You could also check the output from 'last' to see who was logged in at the time.

Dave