Who is deleting the file

[Steve Phillips]

On Fri, Apr 1, 2011 at 12:20 AM, Abhilash abhi <abhilashck72 at gmail.com>wrote:

> And Don't suggest history command..its not possible to log in as individual
> user belongs to X and check history since the number of users under group X
> is so large..and history list is very large and old entries will be
> deleting..
>
>
Why not ?

#!/bin/bash

DELETEDFILE=bob

cd /users
for each in `ls`; do
  if [ -f ${each}/.bash_history ]; then
    echo "Checking directory ${each}"
    grep ${DELETEDFILE} ${each}/.bash_history
  fi
done

(and there are over half a dozen other ways you could do this as well)

-- 
Steve.


>
> On Thu, Mar 31, 2011 at 6:25 PM, Abhilash abhi <abhilashck72 at gmail.com
> >wrote:
>
> > Hi All,
> >
> > I have one directory which contains some files..and the directory is
> owned
> > by some group called X. All files within the directory have group
> membership
> > X since SGID is set .some files are frequently missing from that
> directory
> > and i am restoring it through snapshots(Netapp filer). Is there anyway to
> > find out who is (which user) or by what operation deleted the file??
> >
> > --
> >
> > Regards,
> > Abhilash
> >
> > --
> >
> > Regards,
> > Abhilash
> >
>
>
>
> --
>
> Regards,
> Abhilash
> --
> redhat-list mailing list
> unsubscribe mailto:redhat-list-request at redhat.com?subject=unsubscribe
> https://www.redhat.com/mailman/listinfo/redhat-list
>