Where can I look for clues? And how do I enable audit for file operations in my home folder?
If your system is capable, use the SMART tools to check your drive out (as CM suggests), something like this:
smartctl -a /dev/sda <replace /dev/sda with the drive in question> See how your 'error count log' is doing. If there are errors, then you might want to run that command a few times and see if the error count
is
still rising.
It's a Dell PowerEdge 2950 running in raid 1+0 on the Perc 5/I with SCSI drives.
[root@ora01 ~]# smartctl -a /dev/sda7 smartctl version 5.33 [x86_64-redhat-linux-gnu] Copyright (C) 2002-4 Bruce Allen Home page is http://smartmontools.sourceforge.net/
Device: DELL PERC 5/i Version: 1.03 Serial number: 008f71137876e77c0e00b4fdc230c201 Device type: disk Local Time is: Fri Jan 4 09:43:37 2008 CET Device does not support SMART
Error Counter logging not supported
Error Events logging not supported Device does not support Self Test logging
Is it everything in the /home/online/sh/ directory that is getting deleted, or can you see any pattern at all? (it sounds like it is
random
from what you said...but hard to think of why files would be deleted randomly....as you know!)
No pattern so far. Yeah I know it sounds strange for files to be randomly deleted.
/Christopher