Re: [CentOS] Random files in homedir gets deleted

On Friday 04 January 2008 17:18:25 Radu Radutiu wrote:

Hi you can try to use the kernel audit facility:

1. enable the auditd daemon:

service auditd start

2. enable audit for the home directory (only audit write operations to

the directory inode); the command is not recursive and you cannot use wildcards

auditctl -w /home/user -pw

3. after a file disapears use ausearch to find who removed it (and

what command was used to remove it); suppose file "test" was removed

ausearch -f /home/user/test

Thanks Radu for the directions. I google for more information and found this very nice article: http://www.cyberciti.biz/tips/linux-audit-files-to-see-who-made-changes-to-a...

But it seems that there's no man page for the /etc/audit.rules?