Sponsored Content
Full Discussion: Who deleted my files
Operating Systems AIX Who deleted my files Post 302564769 by Corona688 on Friday 14th of October 2011 02:33:46 PM
Old 10-14-2011
The history file is probably updated when you logout of your shell. until then, the recent things are only in memory.

If you haven't specially enabled some special accounting, it's not going to have records of who deleted what.
 

9 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Retrieval of deleted files

We have a situation in a large dept of programmers where critical accounting data files were deleted. Is there any way in UNIX to trace deletions and or possibly retrieve the deleted file? (14 Replies)
Discussion started by: cgardiner
14 Replies

2. UNIX for Dummies Questions & Answers

restoring deleted files

I had a user run, by accident, the following line command on our UNIX server: rm -f /usr/* This apparently deleted some needed files on your system. Having very limited knowledge in UNIX, I thought I would ask the group if anyone knows how I can recover these file? The version of UNIX is... (3 Replies)
Discussion started by: mikem
3 Replies

3. AIX

recover deleted files

How to recover deleted files in AIX ? (1 Reply)
Discussion started by: vjm
1 Replies

4. Shell Programming and Scripting

Finding deleted files

One of the files got deleted and i want to find who deleted that file. I think we can get the list using history command. Could you please let me know how to get the list of rm commands from history and who previously logged in and did that? Any other suggestions other than history also... (2 Replies)
Discussion started by: Krrishv
2 Replies

5. UNIX for Dummies Questions & Answers

Retrieving deleted files

I mistakenly deleted a script from the UNIX server. Is there any command i can type that i will retrieve my script? (3 Replies)
Discussion started by: manna
3 Replies

6. Shell Programming and Scripting

how to restore the deleted files

hi, if i delete a file from /home/san/abc.cpp in linux/unix and i want to restore it back how to do that ? (3 Replies)
Discussion started by: mail2sant
3 Replies

7. UNIX for Dummies Questions & Answers

Any way to retrieve deleted files?

:eek: I accidently removed some files using 'rm'. Is there any way to retrieve these files if they were deleted through 'rm'? (1 Reply)
Discussion started by: orahi001
1 Replies

8. UNIX for Advanced & Expert Users

deleted all files - rm *

Hi All, I am using Fedora Core and Windows Xp. I deleted all the files from root directory. When i am trying to restart the computer it showing some grub > prompt. What i will do ? I have lots of data in XP OS. Please help me i used # rm * (8 Replies)
Discussion started by: pritish.sas
8 Replies

9. Linux

Need help with deleted files

Hello. I am having a problem and I was wondering if I could get some help from here. I changed into a directory with the cd command and I wanted to delete a folder and all of its subdirectories, so I went ahead and did a rm --recursive * in my current directory to realize that I was in the wrong... (3 Replies)
Discussion started by: jonnydadesigner
3 Replies
acct(1M)																  acct(1M)

NAME
acct: acctdisk, acctdusg, accton, acctwtmp, closewtmp, utmp2wtmp - overview of accounting and miscellaneous accounting commands SYNOPSIS
file] file] [file] reason DESCRIPTION
Accounting software is structured as a set of tools (consisting of both C programs and shell procedures) that can be used to build account- ing systems. The shell procedures, described in acctsh(1M), are built on top of the C programs. Connect time accounting is handled by various programs that write records into the The programs described in acctcon(1M) convert this file into session and charging records which are then summarized by (see acctmerg(1M)). Process accounting is performed by the HP-UX system kernel. Upon termination of a process, one record per process is written to a file (normally The programs in acctprc(1M) summarize this data for charging purposes; is used to summarize command usage (see acctcms(1M)). Current process data can be examined using (see acctcom(1M)). Process accounting and connect time accounting (or any accounting records in the format described in acct(4)) can be merged and summarized into total accounting records by (see the format in acct(4)). is used to format any or all accounting records (see acctsh(1M)). reads lines that contain user ID, login name, and number of disk blocks, and converts them to total accounting records that can be merged with other accounting records. reads its standard input (usually from and computes disk resource consumption (including indirect blocks) by login. Only files found under login directories (as determined from the password file) are accounted for. All files under a login directory are assumed to belong to that user regardless of actual owner. If is given, records consisting of those file names for which charges no one are placed in file (a potential source for finding users trying to avoid disk charges). If is given, file is the name of the password file. This option is not needed if the password file is (See diskusg(1M) for more details.) turns process accounting off if the optional file argument is omitted. If file is given, it must be the name of an existing file, to which the kernel appends process accounting records (see acct(2) and acct(4)). writes a utmp record to its standard output if the option is not used. If the option is used, writes a record to The record contains the current time and a string of characters that describe the reason for writing the record. A record type of is assigned (see utmp(4) and utmps(4)). The string argument reason must be 11 or fewer characters, numbers, or spaces if option is not used. Otherwise, it must be 63 or fewer characters, numbers, or spaces. For example, the following are suggestions for use in reboot and shutdown procedures, respec- tively: writes a record, for each user currently logged in, to the file This program is invoked by runacct to close the existing file before creat- ing a new one. writes a record, for each user currently logged in, to the file This program is invoked by runacct to initialize the newly created file. FILES
Holds all accounting commands listed in section(1M) of this manual. Current process accounting file. Used for converting login name to user ID Login/logoff history file. New login/logoff history database. SEE ALSO
acctcms(1M), acctcom(1M), acctcon(1M), acctmerg(1M), acctprc(1M), acctsh(1M), diskusg(1M), fwtmp(1M), runacct(1M), acct(2), acct(4), utmp(4). utmps(4), wtmps(4). STANDARDS CONFORMANCE
acct(1M)
All times are GMT -4. The time now is 02:22 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy