On Fri, May 14, 2010 at 11:36 AM, Wang, Mary Y <mary.y.wang at boeing.com> wrote: > Hi, > > A directory/subdirectories just disappeared on our dev box, and we don't know what happened. Is there a log file that logs this kind of stuff (such as who/date did a 'rmdir'). The /var/log directory has a lot of files and I'm not sure where to start. Unless auditing is enabled and rules are configured then there's no easy way to tell. You might try looking through the .bash_history files of recently logged in users, but that's not time coded.