Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a common testing environment on AIX for all 15-20 persons. There might be chances that somebody deleted the files mistakenly. In such scenarios, it is very difficult to know who deleted files from a specific location. I would like to generate a report for that same so that we can trace it. In fact, I am looking for following information : < ExecutedCmd>

How can we do that by using shell script ? Please suggest.

share|improve this question
are you using bash? if so you could grep -i "<executedcmd>" /home/*/.bash_history – h3rrmiller Oct 3 '12 at 19:51
Yes, bash. But how i will get an information about follwoing: – sonu Oct 3 '12 at 20:00
<sshd_id><loginDeails ><DateAndTime><ipAddress:portNumber>< ExecutedCmd> – sonu Oct 3 '12 at 20:00
In fact i would like to generate a report for auditing purpose and send it to an email id for auditing purpose. Any suggestions ? – sonu Oct 3 '12 at 20:02
All users in my team using a generic account therefore it is merely impossible to track who mistakenly detected some files. In current scenario it is impossible to trace when, what and from where files are deleted by whom. I appreciate your response regarding this request. How can we do it by shell script ? – sonu Oct 3 '12 at 20:06

Accountability can not exist in an environment with only one user account. For this reason and for many others (granular access control, reliable privilege revocation, account termination upon dismissal, etc.), you should really set up a separate account for each person.

Further, finding out who deleted a file is not going to solve your problem; the file is gone anyway. If the data is mission-critical, it should be backed up regularly and incrementally. There are many ways to do this. rsync with --link-dest is appropriate for large-scale system backups whereas some kind of source control would work better for something like a directory full of text files.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.