Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

A test server that I am working on has had two accounts deleted. It won't be malicious - another department has probably deleted them thinking they are not needed. If I can find out who, we can ensure they don't delete them again :-)

I can't find anything in /var/messages & have had a quick search using google which only pointed me towards /etc/security (which does not contain any logs).

Any idea where I can look or are no details keep of account deletions?

TIA

share|improve this question
add comment

migrated from stackoverflow.com Dec 10 '09 at 15:35

This question came from our site for professional and enthusiast programmers.

6 Answers

See if you have /var/log/auth.log (and its rotations). There may be entries in there for deluser. Unfortunately, you didn't say what distribution you're running.

share|improve this answer
    
+1, you said the same thing but beat me to it, plus you used command ticks... I like the old default sort order better than the random one :-/ –  Kyle Brandt Dec 10 '09 at 16:10
add comment

Default Linux has no accounting of this. You might try to find out who logged in as root, for instance run last and check the output. Alternatively you might look through all users' .bash_history (assuming bash is the default shell of all users) to find traces.

Oh, and this sounds more like a Q for serverfault.

share|improve this answer
add comment

There is no standard log file for this. Depending on your distribution/configuration, all commands run as a sudo might be logged, so you might be able to find a userdel command in something like auth.log if you are using Ubuntu.

share|improve this answer
add comment

Check the shell history of root or any other user that has root access.

share|improve this answer
add comment

Have you tried sending out an email to all the users that have permission to do this on this server? Sometimes a little social engineering goes further than a technical solution.

Now having said that this is a good reason not to use a shared root account but to use sudo to allow users to do administrative tasks using their account. As all sudo actions are logged to /var/log/auth.log and would make tracking this down fairly easy if they made the changes on the command line. If a gui app was used to make these changes all you would see in the log files would be the app being run with elevated privileges...but any operation done with that app would not have any visibility.

share|improve this answer
add comment

Try /var/log/secure* - You should have a few weeks worth of logging there.

grep -i userdel /var/log/secure*
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.