Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to figure out which processes are deleting files from a specific directory on my CentOS server.

I looked at inotify, but all this does is to tell me how many file deletions are occurring; it does not tell me what process run by which user did the deletions, nor does it tell me when they happened.

I also tried auditd, but I have had no luck in getting it set up on my server.

Does anyone have any other tool they can suggest that will do this?

share|improve this question
add comment

closed as not constructive by Michael Hampton, mdpc, Ward, EEAA, Magellan Nov 6 '12 at 15:20

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer

auditd is the correct tool to be using here, man auditctl and set your rules correctly. Some good info: http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.