There is a folder that maybe accessible to multiple users. If there is a file was deleted, is that possible to know which user delete this file and when? Thanks.


Yes. Use audit software. A popular implementation is audit or auditd. To help "prime the pump" on audit rules, one can acquire many audit-related rules for the software via the DISA STIG.

Although the hyperlink points to a STIG (Security Technical Implementation Guide) for RHEL6 (RedHat Linux 6), it is nonetheless a good security baseline that will be mostly appropriate for your Linux system, perhaps with some interpolation to match your Linux.

The software is developed by RedHat but available for any Linux. There is helpful documentation available.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.