LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 06-30-2006, 05:43 PM   #1
onelung02
Member
 
Registered: Oct 2003
Location: utah
Distribution: Slackware 10.0, Gentoo 2006.0
Posts: 289

Rep: Reputation: 30
Delete Logs


Hello,
I am curious if anyone has any information on something that would be able to help me determine who deleted a certain file on a linux box? I know this question might be rather elementary, but I have not been able to come up with anything searching the WWW. I don't know if there is a log that keeps track of these things or what, so any help in the right direction is much appreciated.

-onelung
 
Old 06-30-2006, 07:12 PM   #2
bathory
LQ Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 13,220
Blog Entries: 1

Rep: Reputation: 2074Reputation: 2074Reputation: 2074Reputation: 2074Reputation: 2074Reputation: 2074Reputation: 2074Reputation: 2074Reputation: 2074Reputation: 2074Reputation: 2074
You can take a look at your users's .bash_history, assuming they use bash:
Code:
cd /home
find `ls`/.bash_history -exec /usr/bin/grep "deleted-filename" {} /dev/null \;
If it's a file that only root can delete then look at root's .bash_history, but then you have to find out who was logged as root or su'ed to root. For this the command "last root|more" could help you

Last edited by bathory; 06-30-2006 at 07:22 PM.
 
Old 07-03-2006, 03:02 PM   #3
geebs
LQ Newbie
 
Registered: Mar 2006
Posts: 1

Rep: Reputation: 0
who deleted file

Of course, if you are not defaulting to bash then you need to:

cd /home
vi .sh_history
/[deleted_file]

if you find the command entry that deleted the file, scroll back a few and see if you can tell who.

Additionally, if you don't know the date it was deleted, request a restore from a previous date noting when it first becomes available for restore.
 
Old 04-09-2014, 03:51 AM   #4
sandeep002gupta
Member
 
Registered: Apr 2011
Posts: 96
Blog Entries: 1

Rep: Reputation: 0
what log check if history deleted in linux

Hi,

can I know how to check if any one deleted history command by history -c & .bash_history file.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Can I delete all logs in /var/log? HURRY! Tenover Linux - General 4 01-03-2006 02:09 PM
VAR - logs - when to delete High-gain Linux - Newbie 4 02-27-2005 10:54 AM
Firefox logs user out? Where are error logs? case1984 Linux - General 0 10-09-2004 03:22 PM
How to delete message logs in GAIM? Arodef Linux - Software 1 06-24-2004 06:12 PM
Separate firewall logs and general logs dominant Linux - General 3 04-20-2004 02:26 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 06:42 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration