| Oracle FAQ | Your Portal to the Oracle Knowledge Grid | |
 |
 | |||
| Oracle FAQ | Your Portal to the Oracle Knowledge Grid | |
|
| |||
Home -> Community -> Mailing Lists -> Oracle-L -> RE: Unix Audit
This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.
------_=_NextPart_001_01C02EE0.F92EE148
Content-Type: text/plain;
charset="iso-8859-1"
If you are running the "sh" or "ksh" shell, check the $HOME/.sh_history file of everyone who has the permission level that would allow deleting of the files.
-----Original Message-----
From: dmeng_at_focal.com [mailto:dmeng_at_focal.com]
Sent: Wednesday, October 04, 2000 1:36 PM
To: Multiple recipients of list ORACLE-L
Subject: Unix Audit
Hi All,
This morning one of my databases mysteriously disappeared and I was able to
get it back but, I also want to
find out what happened. I suspect that the unix admin deleted the data
files on OS level but don't know unix
well enough to prove this. I know you can do audits on commands with Unix
but can anyone tell me if it is possible for me to do audit on root user?
TIA
Dennis Meng
Database Administrator
Focal Communications
847-954-8328
-- Please see the official ORACLE-L FAQ: http://www.orafaq.com -- Author: INET: dmeng_at_focal.com Fat City Network Services -- (858) 538-5051 FAX: (858) 538-5051 San Diego, California -- Public Internet access / Mailing Lists -------------------------------------------------------------------- ------_=_NextPart_001_01C02EE0.F92EE148 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printableReceived on Thu Oct 05 2000 - 10:28:55 CDT
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Diso-8859-1">
<META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version =
5.5.2650.12">
<TITLE>RE: Unix Audit</TITLE>
</HEAD>
<BODY>
<P><FONT SIZE=3D2>If you are running the "sh" or =
"ksh" shell, check the $HOME/.sh_history file of everyone who = has the permission level that would allow deleting of the = files.</FONT></P>
<BR>
<P><FONT SIZE=3D2>-----Original Message-----</FONT>
<BR><FONT SIZE=3D2>From: dmeng_at_focal.com [<A =
HREF=3D"mailto:dmeng_at_focal.com">mailto:dmeng_at_focal.com</A>]</FONT>
<BR><FONT SIZE=3D2>Sent: Wednesday, October 04, 2000 1:36 PM</FONT>
<BR><FONT SIZE=3D2>To: Multiple recipients of list ORACLE-L</FONT>
<BR><FONT SIZE=3D2>Subject: Unix Audit</FONT>
</P>
<BR>
<P><FONT SIZE=3D2>Hi All,</FONT>
<BR><FONT SIZE=3D2>This morning one of my databases mysteriously =
disappeared and I was able to</FONT>
<BR><FONT SIZE=3D2>get it back but, I also want to</FONT>
<BR><FONT SIZE=3D2>find out what happened. I suspect that the unix =
admin deleted the data</FONT>
<BR><FONT SIZE=3D2>files on OS level but don't know unix</FONT>
<BR><FONT SIZE=3D2>well enough to prove this. I know you can do audits =
on commands with Unix</FONT>
<BR><FONT SIZE=3D2>but can anyone tell me if it is possible for me to =
do audit on root user?</FONT>
</P>
<P><FONT SIZE=3D2>TIA</FONT>
</P>
<P><FONT SIZE=3D2>Dennis Meng</FONT>
<BR><FONT SIZE=3D2>Database Administrator</FONT>
<BR><FONT SIZE=3D2>Focal Communications</FONT>
<BR><FONT SIZE=3D2>847-954-8328</FONT>
</P>
<P><FONT SIZE=3D2>-- </FONT>
<BR><FONT SIZE=3D2>Please see the official ORACLE-L FAQ: <A =
HREF=3D"http://www.orafaq.com" = TARGET=3D"_blank">http://www.orafaq.com</A></FONT>
<BR><FONT SIZE=3D2>-- </FONT>
<BR><FONT SIZE=3D2>Author: </FONT>
<BR><FONT SIZE=3D2> INET: dmeng_at_focal.com</FONT>
</P>
<P><FONT SIZE=3D2>Fat City Network Services -- (858) =
538-5051 FAX: (858) 538-5051</FONT>
<BR><FONT SIZE=3D2>San Diego, =
California -- Public Internet = access / Mailing Lists</FONT>
<BR><FONT =
SIZE=3D2>---------------------------------------------------------------=
 |
 |