Message-Id: <10640.118602@fatcity.com> From: Brian MacLean Date: Thu, 5 Oct 2000 08:28:55 -0700 Subject: RE: Unix Audit This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C02EE0.F92EE148 Content-Type: text/plain; charset="iso-8859-1" If you are running the "sh" or "ksh" shell, check the $HOME/.sh_history file of everyone who has the permission level that would allow deleting of the files. -----Original Message----- From: dmeng@focal.com [mailto:dmeng@focal.com] Sent: Wednesday, October 04, 2000 1:36 PM To: Multiple recipients of list ORACLE-L Subject: Unix Audit Hi All, This morning one of my databases mysteriously disappeared and I was able to get it back but, I also want to find out what happened. I suspect that the unix admin deleted the data files on OS level but don't know unix well enough to prove this. I know you can do audits on commands with Unix but can anyone tell me if it is possible for me to do audit on root user? TIA Dennis Meng Database Administrator Focal Communications 847-954-8328 -- Please see the official ORACLE-L FAQ: http://www.orafaq.com -- Author: INET: dmeng@focal.com Fat City Network Services -- (858) 538-5051 FAX: (858) 538-5051 San Diego, California -- Public Internet access / Mailing Lists -------------------------------------------------------------------- ------_=_NextPart_001_01C02EE0.F92EE148 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable RE: Unix Audit

If you are running the "sh" or = "ksh" shell, check the $HOME/.sh_history file of everyone who = has the permission level that would allow deleting of the = files.


-----Original Message-----
From: dmeng@focal.com [mailto:dmeng@focal.com]
Sent: Wednesday, October 04, 2000 1:36 PM
To: Multiple recipients of list ORACLE-L
Subject: Unix Audit


Hi All,
This morning one of my databases mysteriously = disappeared and I was able to
get it back but, I also want to
find out what happened. I suspect that the unix = admin deleted the data
files on OS level but don't know unix
well enough to prove this. I know you can do audits = on commands with Unix
but can anyone tell me if it is possible for me to = do audit on root user?

TIA

Dennis Meng
Database Administrator
Focal Communications
847-954-8328

--
Please see the official ORACLE-L FAQ: http://www.orafaq.com
--
Author:
  INET: dmeng@focal.com

Fat City Network Services    -- (858) = 538-5051  FAX: (858) 538-5051
San Diego, = California        -- Public Internet = access / Mailing Lists
---------------------------------------------------------------=