UNIX for Dummies Questions & Answers

Is there a log or command in unix to check who created a user group?

Thanks in advance

No, but only root can create a group.

Thanks for the quick reply

Is there any workaround? Like checking when a group was created and then comparing to when someone su'd to root?

In general, no. The timestamp of /etc/group might be a clue if the creation of the group was the change made to that file. If there are any files with that gid, the timestamp on them and/or the directories that contain them might provide a clue. Going through your daily backups to determine when that group appeared in /etc/group or files using that gid were first encountered might work. And then you can look in sulog and see what you find. The trouble is that root has the power to remove lines from sulog and to otherwise cover his tracks.