A test server that I am working on has had two accounts deleted. It won't be malicious - another department has probably deleted them thinking they are not needed. If I can find out who, we can ensure they don't delete them again :-)

I can't find anything in /var/messages & have had a quick search using google which only pointed me towards /etc/security (which does not contain any logs).

Any idea where I can look or are no details keep of account deletions?


6 Answers 6


See if you have /var/log/auth.log (and its rotations). There may be entries in there for deluser. Unfortunately, you didn't say what distribution you're running.

  • +1, you said the same thing but beat me to it, plus you used command ticks... I like the old default sort order better than the random one :-/ Dec 10, 2009 at 16:10

Default Linux has no accounting of this. You might try to find out who logged in as root, for instance run last and check the output. Alternatively you might look through all users' .bash_history (assuming bash is the default shell of all users) to find traces.

Oh, and this sounds more like a Q for serverfault.


There is no standard log file for this. Depending on your distribution/configuration, all commands run as a sudo might be logged, so you might be able to find a userdel command in something like auth.log if you are using Ubuntu.


Try /var/log/secure* - You should have a few weeks worth of logging there.

grep -i userdel /var/log/secure*

Check the shell history of root or any other user that has root access.


Have you tried sending out an email to all the users that have permission to do this on this server? Sometimes a little social engineering goes further than a technical solution.

Now having said that this is a good reason not to use a shared root account but to use sudo to allow users to do administrative tasks using their account. As all sudo actions are logged to /var/log/auth.log and would make tracking this down fairly easy if they made the changes on the command line. If a gui app was used to make these changes all you would see in the log files would be the app being run with elevated privileges...but any operation done with that app would not have any visibility.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy