a few of some live payroll files have been deleted / missing ... i've restored last nites backup ... what could be the possibilities of this strange occurance ... users have menus to work on and use these live files ... we run an aix box with a ksh shell. Where do I start ??

Thanks

unless they need to, change the permissions on files that they dont need to access.

Hi,

I think it's worth looking on "last -R" about who logged in last. Look at error messages in the messages-file. Look at who was loged in by then. Even a .histrory of users might be worthy to look at. A second look at your security settings might be good I gess.

Payroll is quiet secure stuff, I believe. Please make sure have your server secure.

Regs David

Thanks guys,

I looked in the .sh_history files of the user but could'nt find anything related,

- > Look at error messages in the messages-file.

where would this be ?

Regards
c^d

look in /var/log/

i have no experience with AIX but generally /var/ is where files are kept that will regularly change size. there should be a log/ in /var/ and look for anything readable in that directory-- namely /var/log/messages