Thanks for the info. There are only three of us who have the "root" access and I guess the date/time is more important to us. We are also concerned that there might be a script did the "rmdir" unintentionally.
The .bash_history had some old stuff with an older timestamp of the file. Some of us use csh and there is no history file associated with it.
How do I enable the auditing that you described below?
Mary
-----Original Message-----
From: centos-bounces@xxxxxxxxxx [mailto:centos-bounces@xxxxxxxxxx] On Behalf Of Kwan Lowe
Sent: Friday, May 14, 2010 8:39 AM
To: CentOS mailing list
Subject: Re: A Directory/Subdirectories Disappeared - which logfile to look for this kind of information?
On Fri, May 14, 2010 at 11:36 AM, Wang, Mary Y <mary.y.wang@xxxxxxxxxx> wrote:
> Hi,
>
> A directory/subdirectories just disappeared on our dev box, and we don't know what happened. Is there a log file that logs this kind of stuff (such as who/date did a 'rmdir'). The /var/log directory has a lot of files and I'm not sure where to start.
Unless auditing is enabled and rules are configured then there's no easy way to tell. You might try looking through the .bash_history files of recently logged in users, but that's not time coded.
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
