From owner-freebsd-questions@FreeBSD.ORG Mon Feb 9 20:07:40 2015 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id D9F28FFD for ; Mon, 9 Feb 2015 20:07:40 +0000 (UTC) Received: from mail.indylix.nl (mail.indylix.nl [31.220.44.23]) by mx1.freebsd.org (Postfix) with ESMTP id 9919881B for ; Mon, 9 Feb 2015 20:07:39 +0000 (UTC) Message-ID: <54D91141.3060707@indylix.nl> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=indylix.nl; s=o26EqTc7; t=1423511878; bh=RsF33KPMU8Z9ytBMTRxiY2KYOh5APPXDBJBdgc0oZAU=; h=Date:From:To:Subject:References:In-Reply-To; b=Bav352BS5b0I/d0ZoZS/fW+KIKP/7AlFpNInETfrjO18hwpF6YnVyede9IaB7784N jn+08D39hLmFMJNqQ1s/faUWfOYChkXu56P4QOR0mPdwJjQ7bmEg3PFUSVy57qMo2g IY7JcxTiZXguSm114afE8QntVFbkwhgnywH1h67ue+qeaIcYCgWOkoVuqyB+nvKlFc l4xRCWDmZ3upkW+EUwZf9UydKUs0VN7gBTyebT5fKP4RJMQfEel+XUKVYTdiKrhSye 4V0Zu/6thz4YBgVySxaqWjxMoLKAzLOwpmOfz+EqEOI6yWJ3F1N6TpMs+l4niPXNPS YSKQE79PYBpaQ== Date: Mon, 09 Feb 2015 20:57:53 +0100 From: Robert Sevat MIME-Version: 1.0 To: freebsd-questions@freebsd.org Subject: Re: See which user is deleting files References: In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="2LqkLJIrcUBGgWMSrquqjvoP7mTEBwtRm" X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Feb 2015 20:07:40 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --2LqkLJIrcUBGgWMSrquqjvoP7mTEBwtRm Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Hey, You can turn on auditing and have it specifically log file deletion event= s. https://www.freebsd.org/doc/handbook/audit.html "fd file delete Audit events where file deletion occurs." Kind Regards, Robert Sevat On 02/09/2015 08:55 PM, Jeremy Gransden wrote: > Is there a way to log when files get deleted and by whom? >=20 >=20 > thanks, > J > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd= =2Eorg" >=20 --2LqkLJIrcUBGgWMSrquqjvoP7mTEBwtRm Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJU2RFBAAoJEOBNTiYXv1P06WUP/18ZvwtCagK92aCxFMUptJJe obX+JQkiYm84MadXgAXQvcB8VyIBdhtW+aZcHePuGgbDQeGlvXd4/Qzgsgp95M+C ups6RsWemQ+DSLR2hax1sPn2oV+idMhUPiT97Efo8VJLhdeu4KjFzENwrnhqB48a bSN2xHiCG9d87AU+ZQanEgjNun2t/IWIRaEKStu/5H0B19LpsmbjMnjt+CHOC+Kz fcTcaMrhNfCOlBKxc79FpPhAivGcAVi288UEX1N63gaBH7vdUwUuKW2CumBKl+9M cnbR11YZtSlGi9fSJ0H4PKy6fSvRTBiGGI3iA+quFBvL0c9YDIU4XcF0ojIcJLuU SyAy6XCL0Ik+UUD8PyrpOYivdVk/SfIF3BA4IWFw75e4x3h3x0u7eUrjnFP2d2vR avdyIMdfMm4sr82tqU/y33PPBWBN9OZYOi0YRrDllj5I6HjV3KzapFWWNMbdB9wx BK37YSKufuYsx5dqJ5lVHuINhVNGir89ceIbKYqfrCa7eRzVGYqvqA5uQyMwWyar aHtJJmM8jR/T/cDEhf5DuZ5UzX8rgL7IbjsyNAgZNbN6TNjSaAVm8HmN2htauEJx 01SCqreHTxOo6oLVcak6sZrfLiVweZVMXCNHMqA1uxAeD5S32ag+TR5zHhLlbvsr ljL16qOQ0FwoZL+t0dOA =D7jW -----END PGP SIGNATURE----- --2LqkLJIrcUBGgWMSrquqjvoP7mTEBwtRm--