how to trace the logs

vivek_damodaran · #1 (**permalink**) 05-13-2008

Hi,

Last day, In one of our unix boxes there was an issue wherein few of the directory structures were missing / got deleted.

Is there any way by which we can find how it happened, I mean by going through syslog / which user had run what command?

Thanks for your help

era · #2 (**permalink**) 05-13-2008

Usually no. Some sites are set up with detailed auditing logs but if you had those, you wouldn't be asking (and we wouldn't be able to guess which system you have anyway).

vivek_damodaran · #3 (**permalink**) 05-13-2008

Era,

Its a HP-UX machine

#uname -a
HP-UX byfusp01 B.11.11 U 9000/800 909053493 unlimited-user license

vbe · #4 (**permalink**) 05-13-2008

Who have rights (the required priviledges...) on thoses directories?
You could look at their .sh_history...
Has the server been rebooted lately? In some strange situations filesytems get mounted in bad order and so you dont get expected results: a classical we see is /opt/oracle mounted after /opt/oracle/product/...

Other UNIX.COM Threads You Might Find Helpful
Thread	Thread Starter	Forum	Replies	Last Post
Trace DHCP - Help!	nuGuy	UNIX for Dummies Questions & Answers	0	04-27-2008 10:00 AM
Function Trace	ajcannon	Shell Programming and Scripting	3	10-05-2007 12:55 AM
trace route ip	ppass	IP Networking	2	01-11-2005 07:50 AM
How to trace a user	salhoub	HP-UX	3	06-27-2004 04:44 AM
Trace connections	jraitsev	UNIX for Advanced & Expert Users	8	03-14-2002 02:00 AM

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode