In my company we use Alpha stations running on Tru64.
Some files were delete without any authorisation, and I would like to know
how can I investigate when and who has send the commands?
Also I know the "at" command how can I be sure there is not an "at
xx-xx-2005 rm *" hidden in my machine ?
Thanks a lot, and sorry for such stupid questions!!!
Matthieu
The command:
at -l
Will list all 'at' jobs for the current user.
As far as a command history goes, it depends on the shell.. and can
vary between operating systems and setups.. of course, users are able
to forge and/or delete their history files.. so don't trust them :)