One of the files got deleted and i want to find who deleted that file.
I think we can get the list using history command. Could you please let me know how to get the list of rm commands from history and who previously logged in and did that?
Any other suggestions other than history also welcome.
try looking for "recover" command in /usr/bin. if it there on your system, it would help you in getting the file as well as it would answer your questions too.
--Manish
I dont have any recovery command in hp-ux or RHLinux. which flavour of unix is this
$ ls -ltr re*
-r-xr-xr-x 1 bin bin 24576 Mar 11 2004 rev
-r-xr-xr-x 2 bin bin 90112 Mar 11 2004 red
-r-xr-xr-x 2 bin bin 36864 Mar 11 2004 reset
-r-xr-xr-x 1 bin bin 151 Mar 26 2004 read
lr-xr-xr-t 1 root sys 22 Aug 10 08:35 revck -> /usr/old/usr/
bin/revck
lr-xr-xr-t 1 root sys 16 Aug 10 08:35 renice -> /usr/sbin/re
nice
-r-sr-xr-x 1 root bin 53248 Oct 17 09:49 remsh
-r-sr-xr-x 1 root bin 32768 Oct 17 09:49 rexec
-r-xr-xr-x 1 bin bin 225280 Nov 29 20:15 readmail
$ pwd
/usr/bin
$ uname -a
HP-UX td191 B.11.23 U 9000/800 1294588977 unlimited-user license
Linux :
$ ls -ltr re*
-r-xr-xr-x 1 bin bin 24576 Mar 11 2004 rev
-r-xr-xr-x 2 bin bin 90112 Mar 11 2004 red
-r-xr-xr-x 2 bin bin 36864 Mar 11 2004 reset
-r-xr-xr-x 1 bin bin 151 Mar 26 2004 read
lr-xr-xr-t 1 root sys 22 Aug 10 08:35 revck -> /usr/old/usr/
bin/revck
lr-xr-xr-t 1 root sys 16 Aug 10 08:35 renice -> /usr/sbin/re
nice
-r-sr-xr-x 1 root bin 53248 Oct 17 09:49 remsh
-r-sr-xr-x 1 root bin 32768 Oct 17 09:49 rexec
-r-xr-xr-x 1 bin bin 225280 Nov 29 20:15 readmail
$ pwd
/usr/bin
$ uname -a
HP-UX td191 B.11.23 U 9000/800 1294588977 unlimited-user license