please bottom post, more at the bottom ... On May 14, 2010, at 11:50 AM, Wang, Mary Y wrote: > Thanks for the info. There are only three of us who have the "root" > access and I guess the date/time is more important to us. We are > also concerned that there might be a script did the "rmdir" > unintentionally. > The .bash_history had some old stuff with an older timestamp of the > file. Some of us use csh and there is no history file associated > with it. > > How do I enable the auditing that you described below? > > > Mary > > > -----Original Message----- > From: centos-bounces at centos.org [mailto:centos-bounces at centos.org] > On Behalf Of Kwan Lowe > Sent: Friday, May 14, 2010 8:39 AM > To: CentOS mailing list > Subject: Re: [CentOS] A Directory/Subdirectories Disappeared - which > logfile to look for this kind of information? > > On Fri, May 14, 2010 at 11:36 AM, Wang, Mary Y > <mary.y.wang at boeing.com> wrote: >> Hi, >> >> A directory/subdirectories just disappeared on our dev box, and we >> don't know what happened. Is there a log file that logs this kind >> of stuff (such as who/date did a 'rmdir'). The /var/log directory >> has a lot of files and I'm not sure where to start. > > Unless auditing is enabled and rules are configured then there's no > easy way to tell. You might try looking through the .bash_history > files of recently logged in users, but that's not time coded. > _______________________________________________ If no other directories or files have been added or deleted to the parent directory of the missing directory, then the time stamp of the parent directory will tell you when the directory was deleted. Tony Schreiner