a directory was moved with mv command in a Linux box, what logs should be looked at for such action? in root bash_history i can see the command was used, unfortunatly bash_history was not recording time & date, therefore making it difficult to trace.
Regards and thanks.
Vlad, as a rule of thumb (unless you have system auditing enabled, which most admins avoid because of the huge overheads it can incur) file activities aren't actually logged in Linux land. To make your .bash_history more useful for future events you may want to add the following lines to your .bashrc:
# append to the history file, don't overwrite it
shopt -s histappend
# write out each command, useful if you have many sessions/shells open at the same time, or run the risk of having an unclean session termination
export PROMPT_COMMAND='history -a'
# 'normal' history stuff
export HISTFILESIZE=8000
export HISTSIZE=6000
export HISTTIMEFORMAT="%F %T%n"
sudo, it logs each individual command it is used for.