Hi,
Last day, In one of our unix boxes there was an issue wherein few of the directory structures were missing / got deleted.
Is there any way by which we can find how it happened, I mean by going through syslog / which user had run what command?
Thanks for your help
Usually no. Some sites are set up with detailed auditing logs but if you had those, you wouldn't be asking (and we wouldn't be able to guess which system you have anyway).
Era,
Its a HP-UX machine
#uname -a
HP-UX byfusp01 B.11.11 U 9000/800 909053493 unlimited-user license
Who have rights (the required priviledges...) on thoses directories?
You could look at their .sh_history...
Has the server been rebooted lately? In some strange situations filesytems get mounted in bad order and so you dont get expected results: a classical we see is /opt/oracle mounted after /opt/oracle/product/...