up vote 1 down vote favorite
share [g+] share [fb]

I'm working in solaris server machine. More than 10 people are logged in to the same server machine.It take one hour for finishing the installation. But after the installation is over , some other user is deleting some of the directories and files in my installation folder. Is there any way to know who removed the files? Or atleast I want to know can I see the command history of other users.

link|improve this question
feedback

migrated from stackoverflow.com Feb 25 '10 at 12:09

This question came from our site for professional and enthusiast programmers.

3 Answers

up vote 3 down vote

But after the installation is over , some other user is deleting some of the directories and files in my installation folder.

"Occam's razor" - especially if this has happened multiple times - suggests that it's probably not another user at all, but the installation script...

link|improve this answer
feedback
up vote 1 down vote

Solaris has extensive auditing capabilities including tracing file destruction (fd audit_class): http://docs.sun.com/app/docs/doc/816-4557/auditov-1?a=view

man bsmconf audit_control audit_class

Reading this blog page would be a good start: http://www.cuddletech.com/blog/pivot/entry.php?id=647

Of course, if all users share the same account or if your server allows to remotely log in as root, that wouldn't help that much figuring out who is behind these deletions ...

link|improve this answer
feedback
up vote 0 down vote

If your shell is bash look through file ~/.bash_history for commands history

link|improve this answer
3  
That would give him his own command history, won't it? – Ofir Feb 25 '10 at 16:03
1  
Well if they are equal, the others also have root like he does. Then just check the other .bash_history files for traces. (cat /home/suspect/.bash_history | grep myusername) – Shiki May 18 '10 at 15:20
feedback

Your Answer

 
or
required, but never shown
discard