A test server that I am working on has had two accounts deleted. It won't be malicious - another department has probably deleted them thinking they are not needed. If I can find out who, we can ensure they don't delete them again :-)
I can't find anything in /var/messages & have had a quick search using google which only pointed me towards /etc/security (which does not contain any logs).
Any idea where I can look or are no details keep of account deletions?