5

Is there a way to see what files an user deletes during his/her daily work. I know about bash_history, but I wonder if there is something more than this. The question is about plain Ubuntu (presumably any Linux) server installation.

If a user runs rm -fr dir1 in its home directory, would there be a log of the event? Do I have a way to easily enable such a feature?

Edit: Can I find out before installing anything? Both answers are excellent!

Thanks

10

To monitor file system manipulation, you'll need to use inotify or the built-in auditing system with the kernel. Take a look at this page for a brief overview of your options. The man pages for inotify and auditctl are also very valuable.

These processes will tell you whenever a certain file is altered, whether or not it is done as a command in the user's history (e.g. through a GUI file manager, etc).

  • 1
    +1, inotify allows for arbitrary scripting of events that happen on the filesystem. So you can have it email you if someone manipulates files, such as their history file, or just keep a running log of deleted files. – Spencer Rathbun May 5 '11 at 19:57
7

You can enable process accounting to do this.

apt-get install acct

After it's installed you will be able to see all commands run by a user using lastcomm username. man lastcomm for more options.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.