please bottom post, more at the bottom ...
On May 14, 2010, at 11:50 AM, Wang, Mary Y wrote:
Thanks for the info. There are only three of us who have the "root" access and I guess the date/time is more important to us. We are also concerned that there might be a script did the "rmdir" unintentionally. The .bash_history had some old stuff with an older timestamp of the file. Some of us use csh and there is no history file associated with it.
How do I enable the auditing that you described below?
Mary
-----Original Message----- From: centos-bounces@centos.org [mailto:centos-bounces@centos.org] On Behalf Of Kwan Lowe Sent: Friday, May 14, 2010 8:39 AM To: CentOS mailing list Subject: Re: [CentOS] A Directory/Subdirectories Disappeared - which logfile to look for this kind of information?
On Fri, May 14, 2010 at 11:36 AM, Wang, Mary Y mary.y.wang@boeing.com wrote:
Hi,
A directory/subdirectories just disappeared on our dev box, and we don't know what happened. Is there a log file that logs this kind of stuff (such as who/date did a 'rmdir'). The /var/log directory has a lot of files and I'm not sure where to start.
Unless auditing is enabled and rules are configured then there's no easy way to tell. You might try looking through the .bash_history files of recently logged in users, but that's not time coded. _______________________________________________
If no other directories or files have been added or deleted to the parent directory of the missing directory, then the time stamp of the parent directory will tell you when the directory was deleted.
Tony Schreiner