1

I'm trying to figure out which processes are deleting files from a specific directory on my CentOS server.

I looked at inotify, but all this does is to tell me how many file deletions are occurring; it does not tell me what process run by which user did the deletions, nor does it tell me when they happened.

I also tried auditd, but I have had no luck in getting it set up on my server.

Does anyone have any other tool they can suggest that will do this?

Improve this question

1 Answer 1

Reset to default
1

auditd is the correct tool to be using here, man auditctl and set your rules correctly. Some good info: http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf

Improve this answer

Not the answer you're looking for? Browse other questions tagged .