Some ideas. You can create a cron job to check file existence once per minute so you know exactly when the files disappear. Then check login history (command `last') to see who logs in at the time.
You can create a huge file so deleting it takes a few seconds. Run `top -b' forever and log to a file. 'rm' will be shown in the log.
If the 'rm' does not have -f, chmod 000 the file or a file so it hangs till you have time to see the rm process.
If the 'rm' is not written as '/bin/rm' or '\rm', create alias rm='rm -i' in suspect users' profile so the rm will hang. (May not be a good idea to change /etc/profile without thorough testing.)
--
redhat-list mailing list
unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/redhat-list
