Is there a way to find out who have deleted a recent data from that server and laso where is the sulog is stote

 
Hi ,

Is there a way to find out who have deleted a recent data from that server and laso where is the sulog is stored .or is there any other way to find that information ..I see in the .sh_bash_history that tell me that the rm -Fr commands have been run against those dir ...But i can't say for certain .. ..
kaka123Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

cedarghostCommented:
The location of the sulog varies based on what flavor of Linux you are using. You can use the locate command to find it. If you have never used locate before first type updatedb then type locate sulog. That should give you the location of the sulog. That log will give you a list of successful and unsuccessful su attempts along with the dates. That may be able to help you figure it out. If the server hasn't been restarted since the files were deleted, you may be able to recover them if there is a process still using them in your proc directory. (see this article for a how-to: http://www.linux.com/feature/32026)
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
kaka123Author Commented:
# updatedb
-bash: updatedb: command not found
 # locate sulog
-bash: locate: command not found
# cat /etc/issue
# cat /etc/SuSE*
SUSE LINUX Enterprise Server 9 (i586)
VERSION = 9
PATCHLEVEL = 3

0
jkrCommented:
If you can't 'locate', try

find / -name sulog -print
0
The Ultimate Tool Kit for Technolgy Solution Provi

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy for valuable how-to assets including sample agreements, checklists, flowcharts, and more!

kaka123Author Commented:
it did not find anything ...
0
jkrCommented:
Try a wildcard:

find / -name "sulog*" -print
0
kaka123Author Commented:
nothing
0
kaka123Author Commented:
may be it is not setup ??is there any other log file that i can check??
0
cedarghostCommented:
What version of Linux?
0
jkrCommented:
>> may be it is not setup ??

If nothing is found, this is very likely.
0
kaka123Author Commented:
SUSE LINUX Enterprise Server 9 (i586)
VERSION = 9
PATCHLEVEL = 3
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
System Programming

From novice to tech pro — start learning today.