Logs for File Deletion?

I have a situation where I don't want to recover a file... I want to see how it was deleted.
Is there any way to review file deletions via Apple log files or any other method? My research so far says no... but perhaps someone is craftier than I've proven to be.

An unfortunate circumstance to be sure. Out of curiosity is there any particular reason you can't use ClamXAV rather than NAV?
I suppose that if NAV has a log and nothing relevant is in the log, then you're at a loss to even know if NAV is responsible for the folder's mysterious disappearance. Maybe you have technically savvy cockroaches in the building that come out at night to play? An informational age version of Archie and Mehitabel?
This experience may be an impetus to install software that keeps track of what's installed or removed from a computer. Doesn't help much now but it would be useful in the future.
Oh, one thing comes to mind - file recovery software:
Data Rescue II
File Salvage
TechTool Pro
Message was edited by: Kappy

Similar Messages

HT204053 best storage for filies deleted but used frequently wd drop box flash drive

best storage for filies deleted but used frequently wd drop box flash drive

Thanks LowLuster! With that info I have another questions if that's ok. First, I'm sure it's formatted to fat32. I have learned I can't transfer movies over 4gb. I use an external hard drive for those. The files are ones I've downloaded from YouTube in the mp4 format and are never over 1gb. They're all mb in size.
I didn't realize flash drives had limited writes. Is there any way to confirm I've reached the limit? Both times I reformatted it I was able to add back the videos I previously had on it. I would say there were a hundred or so. Both times I left some "growing room" on the flash drive so I could add more files. And, both times I was able to continuing adding until I had reached the max capacity. The problem occured after I tried deleting files to free up space. Does this make sense with "the amount you have used it" theory? Does it start to become buggy at that point, or does it just make writes to the drive impossible?
Thanks

Log for cube deletion

hi all,
how can we see the log for deletion of the Infoprovider.
for ex i deleted pur cube but i need to the see the log which pur cube deleted by whom i.e user and date and time.
any table is there for the above data.
please help me.
thanks
pinky reddy

Hi,
use transaction slg1. Enter RSD as object and CUBE_DEL or ODSO_DEL as subobject. Run the transaction and you will get a list about deleted cubes or ods-objects as well as the time and the user who deleted the object.
regards
Siggi

Search event logs for file system access

I'm looking to create a script that will allow me to search Windows 2012 security event logs for access to specific folders. Ideally it would allow the granularity to search for read access events (4663) and specify specific users to view. One
example would be to show events for drive F:\ where the folder name is JSmith (including subfolders) and the username is not JSmith.
I've tried something like this, but can't see how to filter.
Get-EventLog security | ? {$_.Message.contains("F:\JSmith")}

Is the match explicit? How can I use wildcard? How can I exclude events?
I recommend asking a search engine and doing some initial research. Here's a starter:
https://technet.microsoft.com/en-us/library/hh849682.aspx
http://blogs.msdn.com/b/powershell/archive/2009/06/11/windows-event-log-in-powershell-part-ii.aspx
http://blogs.technet.com/b/ashleymcglone/archive/2013/08/28/powershell-get-winevent-xml-madness-getting-details-from-event-logs.aspx
http://blogs.technet.com/b/heyscriptingguy/archive/2011/01/24/use-powershell-cmdlet-to-filter-event-log-for-easy-parsing.aspx
https://richardspowershellblog.wordpress.com/2009/03/08/get-winevent/
Don't retire TechNet! -
(Don't give up yet - 13,225+ strong and growing)

888k Error in ULS Logs for File System Cache

Hello,
We have a SharePoint 2010 farm in a three-tier architecture with multiple WFEs and APP servers.
Roughly once a week we will have a number of WFEs seize up and jump to 100% CPU usage. Usually they come in pairs; two servers will jump to 100% at the same time while all the other servers are fine in the 20% - 50% range.
Corresponding to the 100% CPU spike, the following appear in the ULS logs:
"File system cache monitor encoutered error, flushing in memory cache: System.IO.InternalBufferOverflowException: Too many changes at once in directory:C:\ProgramData\Microsoft\SharePoint\Config\<GUID>\."
When these appear, the ULS logs will show hundreds back-to-back flooding the logs.
I have yet to figure out how to stop these and bring the CPU usage down while the incident is happening, and how to prevent them in the future.
While the incident is happening, I have tried clearing the configuration cache, shutting the timer jobs down on each server, deleting all the files but config.ini in the folder listed above, changing config.ini to 1, and restarting the timer. The CPU will
drop momentarily during this process, but as soon as all the timer jobs are restarted the CPUs jump back to 100% on the same servers.
This week as part of my weekly maintenance I thought I'd be proactive and clear the cache even though the behavior wasn't happening, and all CPUs were normal. As soon as I finished, the CPU on two servers that were previously fine jumped to 100% and wouldn't
come down. Needless to say, users complain of latency when servers are at 100% CPU.
So I am frustrated. The only thing I have found that works when the CPUs jump to 100% with these errors are a reboot. Nothing else, including IISReset and stopping/starting the admin and timer job services work. Being Production systems, reboots during the
middle of the day are bad.
Any ideas? I have scoured the Internet resources on this error and have come up relatively empty-handed. All the articles reference clearing the configuration cache, which, in my instance, does not get rid of these issues, and can even trigger them.
Thanks,
Joseph Irvine

Take a look at http://support.microsoft.com/kb/952167 for the list of recommended exclusions per Microsoft.
Trevor Seward
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Logs for query deletion

I can not seem to find a log file for deletion of queries.
I want to be able to track who and when a query is deleted. Any ideas? Does anybody know if this is logged?
Cheers,
Kevin.

An unfortunate circumstance to be sure. Out of curiosity is there any particular reason you can't use ClamXAV rather than NAV?
I suppose that if NAV has a log and nothing relevant is in the log, then you're at a loss to even know if NAV is responsible for the folder's mysterious disappearance. Maybe you have technically savvy cockroaches in the building that come out at night to play? An informational age version of Archie and Mehitabel?
This experience may be an impetus to install software that keeps track of what's installed or removed from a computer. Doesn't help much now but it would be useful in the future.
Oh, one thing comes to mind - file recovery software:
Data Rescue II
File Salvage
TechTool Pro
Message was edited by: Kappy

Log for Addition/Deletion of object in a Transport Request

Dear Friends,
Recently I had a issue where I tried deleting an object from a transport request and I got the message that object is deleted successfully.
But when the transport was imported then it failed with Sy-subrc 8 because of the same object in transport. The reason for the same could be :
1.) Either the object was not deleted from the transport request.
2.) Or Some one else added the same object again in the request.
I want to read the log of this transport in such a way that I see when a object has been added/deleted from a transport request along with SAP User ID of the person doing it.
Is this possible ? If so kindly share the steps with me.
Thanks a Lot for your kind help!!! This is very important for me....
Regards,
Lalit

Hello Lalit
I hope nothing of that sort is available as the transport requests will again have tasks under them.
The changes done to the task will have to be tracked in that case but SAP doesn't have that task change logging as far as I know.
All E0* tables relates to transports and objects under these transports none of them have logs on this nor even any transactions which allow user to edit the transport object.
You get an action log which provides who created it and who releaed them.
But if you configure CharM on Solution manager I hope you can track each changes.
Regards
Vivek

Set Permissions for file deletion

I need to create a new temp directory and at the end of my program, I need to delete the temp files...pretty common thing to do. My problem is the permissions dont allow me to delete the files unless I set them first somehow. I want to know what the settings must be in the Set Permission.VI so I can then delete the files. How do I mechanize this?

Are you having this issue in both the Development Environment and the Run Time Environment? The second solution that I linked is for executables only, and only makes it so that you don't have to turn off the UAC because it has administrative privilages. Anything that an administrator is able to do, the executable will now have permission to do. To test if this solution will work at all, just right click on the executable and select "Run as Administrator". If you are still having issues when the executable is running as administrator, the above solution will not work.
Try running this snippet and let me know what happens. All it does is create a file in the temp directory, read its permissions, then deletes the file. This runs on my computer with no error in the Development Environment and has the permissions of binary 110110110 (Decimal 438).

Archive logs sequence - files deleted

Hi,
I am running one server (e.g. Production) on Archivelogs, and applying these to refresh standby on another server. During one of my activities, I accidentally deleted some Archivelogs that Production server generated. At this time, the database was idle, i.e. without any activity, except what I was doing.
So, I had a archivelogs sequence as:
ARC04482_0123456789.001
ARC04483_0123456789.001
ARC04484_0123456789.001
ARC04485_0123456789.001
And, I accidentally deleted from ARC04486 to ARC04568. Now, I have two archivelogs in standby:
ARC04485_0670557214.001
ARC04569_0670557214.001
How would the sequence work and if these logs would be applied to the recovery (refresh) process as normal, or the process would always look for ARC04486 log?
I am still newbie and wanted to clarify the above. Hope it makes sense.
Thanks,

>
So, does it mean there's no way unless I (somehow) recover the missing archivelogs in sequence?
>
If it is possible to "recover" the missing archivelogs then yes. Do that. That is the easiest way, however, I have a feeling you don't have a copy of them laying around or you wouldn't be asking this question. :)
You should be able to do this by taking an incremental backup of the primary starting from the current scn on the standby. Something like:
BACKUP INCREMENTAL FROM SCN "current_standby scn" DATABASE
Cancel managed recovery mode on the standby, recover the database with the new incremental backup (RECOVER DATABASE NOREDO), then bring the standby back up in managed recovery mode.
Search MOS for "roll forward standby" for complete steps.

Strange request for file deletion

When I have to delete a file in my documents folder (and only in that folder) finder asks me my admin password. I checked my permissions and they are RW (so it seems to me everything's allright); I tried even to click on "apply to all included elements" (sorry for my translation: I'm italian ) but no change happened.
Thanks for help,
Emilio.

Are the files you're deleting in your home folder? If so, can you move them to the Desktop and back without being prompted for a password?

Log for resouce deletion from newtwork activity

Hello
I want to know table from where I can find out if the resouces deleted from network activity "person assignment" tab which was assigned eralier.
Deepak

S.P,
In Psa u have a option for delete the Request for last 20 days based on client u can define the psa data deletion.
Go to tab u have a options to logview and select what date u want and displayed all the logs.
i think it is useful to u
regards,
Lakshmi

Logs for checking Deleted Objects

Dear Experts,
Some objects (ODS, Cubes, Rules, etc) have been deleted in the BI System. Is there a way I can check who and when was this object deleted.
I want details which shall help.
Thanks and BR,
Raj Jain

Hi Raj,
Check in T.code SLG1..
      Object : RSD
Subobject :
                   CUBE_DEL      (Deleting InfoCubes)
                    IOBJ_DEL     (Deleting InfoObjects)
                   ODSO_DEL     (Deleting ODS objects)
Give the time restriction period and execute..
Hope it will help..
Regards,
Siva.

XML Publisher - OPP log: Output file was found but is zero sized - Deleted

Hi,
I have created one Main template and sub-template is called from it. I am working with Oracle Apps version 12.1.1. XML Source file gets created using rdf file attached to the concurrent program. Now after registering main template with the required concurrent program when i tried to execute it "View Output" button shows XML souce data instead of PDF report which i have called using main template. Log file was showing following error,
Executing request completion options...
Output file size:
33140
------------- 1) PUBLISH -------------
Beginning post-processing of request 3739501 on node ORAAPP13 at 09-AUG-2011 22:16:38.
Post-processing of request 3739501 failed at 09-AUG-2011 22:16:51 with the error message:
One or more post-processing actions failed. Consult the OPP service log for details.
------------- 2) PRINT   -------------
Not printing the output of this request because post-processing failed.
Finished executing request completion options.
And the OPP service log has following error, Can anyone guide me to solve this error.
Template code: AERO_INV_MAIN
Template app: XXAV
Language: en
Territory: US
Output type: PDF
[8/9/11 10:16:51 PM] [339827:RT3739501] Output file was found but is zero sized - Deleted
[8/9/11 10:16:51 PM] [UNEXPECTED] [339827:RT3739501] java.lang.reflect.InvocationTargetException
     at sun.reflect.GeneratedMethodAccessor66.invoke(Unknown Source)
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
     at java.lang.reflect.Method.invoke(Method.java:597)
     at oracle.apps.xdo.common.xml.XSLT10gR1.invokeNewXSLStylesheet(XSLT10gR1.java:611)
     at oracle.apps.xdo.common.xml.XSLT10gR1.transform(XSLT10gR1.java:239)
     at oracle.apps.xdo.common.xml.XSLTWrapper.transform(XSLTWrapper.java:182)
     at oracle.apps.xdo.template.fo.util.FOUtility.generateFO(FOUtility.java:1044)
     at oracle.apps.xdo.template.fo.util.FOUtility.generateFO(FOUtility.java:997)
     at oracle.apps.xdo.template.fo.util.FOUtility.generateFO(FOUtility.java:212)
     at oracle.apps.xdo.template.FOProcessor.createFO(FOProcessor.java:1665)
     at oracle.apps.xdo.template.FOProcessor.generate(FOProcessor.java:975)
     at oracle.apps.xdo.oa.schema.server.TemplateHelper.runProcessTemplate(TemplateHelper.java:5936)
     at oracle.apps.xdo.oa.schema.server.TemplateHelper.processTemplate(TemplateHelper.java:3459)
     at oracle.apps.xdo.oa.schema.server.TemplateHelper.processTemplate(TemplateHelper.java:3548)
     at oracle.apps.fnd.cp.opp.XMLPublisherProcessor.process(XMLPublisherProcessor.java:302)
     at oracle.apps.fnd.cp.opp.OPPRequestThread.run(OPPRequestThread.java:176)
Caused by: java.lang.StackOverflowError
     at java.text.DecimalFormat.subformat(DecimalFormat.java:877)
     at java.text.DecimalFormat.format(DecimalFormat.java:674)
     at java.text.DecimalFormat.format(DecimalFormat.java:608)
     at java.text.SimpleDateFormat.zeroPaddingNumber(SimpleDateFormat.java:1203)
     at java.text.SimpleDateFormat.subFormat(SimpleDateFormat.java:1142)
     at java.text.SimpleDateFormat.format(SimpleDateFormat.java:899)
     at java.text.SimpleDateFormat.format(SimpleDateFormat.java:869)
     at java.text.DateFormat.format(DateFormat.java:316)
     at oracle.apps.fnd.security.CallStack.getInstance(CallStack.java:97)
     at oracle.apps.fnd.security.DBConnObj.setBorrowingThread(DBConnObj.java:990)
     at oracle.apps.fnd.security.DBConnObj.setBorrowingThread(DBConnObj.java:973)
     at oracle.apps.fnd.common.Pool.costBasedSelection(Pool.java:1885)
     at oracle.apps.fnd.common.Pool.selectObject(Pool.java:1686)
     at oracle.apps.fnd.common.Pool.borrowObject(Pool.java:950)
     at oracle.apps.fnd.security.DBConnObjPool.borrowObject(DBConnObjPool.java:584)
     at oracle.apps.fnd.security.AppsConnectionManager.borrowConnection(AppsConnectionManager.java:330)
     at oracle.apps.fnd.common.Context.borrowConnection(Context.java:1719)
     at oracle.apps.fnd.common.AppsContext.getPrivateConnectionFinal(AppsContext.java:2314)
     at oracle.apps.fnd.common.AppsContext.getPrivateConnection(AppsContext.java:2251)
     at oracle.apps.fnd.common.AppsContext.getJDBCConnection(AppsContext.java:2108)
     at oracle.apps.fnd.common.AppsContext.getJDBCConnection(AppsContext.java:1918)
     at oracle.apps.fnd.common.AppsContext.getJDBCConnection(AppsContext.java:1762)
     at oracle.apps.fnd.common.AppsContext.getJDBCConnection(AppsContext.java:1775)
     at oracle.apps.fnd.common.Context.getJDBCConnection(Context.java:1453)
     at oracle.apps.fnd.cache.GenericCacheLoader.load(GenericCacheLoader.java:170)
     at oracle.apps.fnd.profiles.Profiles.getProfileOption(Profiles.java:1500)
     at oracle.apps.fnd.profiles.Profiles.getProfile(Profiles.java:362)
     at oracle.apps.fnd.profiles.ExtendedProfileStore.getSpecificProfileFromDB(ExtendedProfileStore.java:211)
     at oracle.apps.fnd.profiles.ExtendedProfileStore.getSpecificProfile(ExtendedProfileStore.java:171)
     at oracle.apps.fnd.profiles.ExtendedProfileStore.getProfile(ExtendedProfileStore.java:148)
     at oracle.apps.fnd.common.logging.DebugEventManager.configureUsingDatabaseValues(DebugEventManager.java:1294)
     at oracle.apps.fnd.common.logging.DebugEventManager.configureLogging(DebugEventManager.java:1149)
     at oracle.apps.fnd.common.logging.DebugEventManager.internalReinit(DebugEventManager.java:1118)
     at oracle.apps.fnd.common.logging.DebugEventManager.reInitialize(DebugEventManager.java:1085)
     at oracle.apps.fnd.common.logging.DebugEventManager.reInitialize(DebugEventManager.java:1072)
     at oracle.apps.fnd.common.AppsLog.reInitialize(AppsLog.java:595)
     at oracle.apps.fnd.common.AppsContext.initLog(AppsContext.java:602)
     at oracle.apps.fnd.common.AppsContext.initializeContext(AppsContext.java:579)
     at oracle.apps.fnd.common.AppsContext.initializeContext(AppsContext.java:533)
     at oracle.apps.fnd.common.AppsContext.<init>(AppsContext.java:301)
     at oracle.apps.xdo.oa.schema.server.OAURLConnection.getAppsContext(OAURLConnection.java:121)
     at oracle.apps.xdo.oa.schema.server.TemplateURLConnection.getInputStream(TemplateURLConnection.java:89)
     at java.net.URL.openStream(URL.java:1009)
     at oracle.xdo.parser.v2.XMLReader.openURL(XMLReader.java:2353)
     at oracle.xdo.parser.v2.XMLReader.pushXMLReader(XMLReader.java:270)
     at oracle.xdo.parser.v2.XMLParser.parse(XMLParser.java:256)
     at oracle.xdo.parser.v2.XSLBuilder.processIncludeHref(XSLBuilder.java:1045)
     at oracle.xdo.parser.v2.XSLBuilder.processImportHref(XSLBuilder.java:984)
     at oracle.xdo.parser.v2.XSLBuilder.processImport(XSLBuilder.java:949)
     at oracle.xdo.parser.v2.XSLBuilder.startElement(XSLBuilder.java:373)
     at oracle.xdo.parser.v2.NonValidatingParser.parseElement(NonValidatingParser.java:1252)
     at oracle.xdo.parser.v2.NonValidatingParser.parseRootElement(NonValidatingParser.java:338)
     at oracle.xdo.parser.v2.NonValidatingParser.parseDocument(NonValidatingParser.java:285)
Regards,
Priyanka

And metalink note 1100253.1 states that this issue (java.lang.StackOverflowError) might be caused by a too large set of data to be sorted in the layout file. Recommendation is to removed the sort from the layout file and instead sort the data already in the data definition.
regards,
David.

Retain Console System.log Events file for Usage Analysis

I recently became interested in tracking the usage of some Apple computers. I discovered that the system.log events file in Console provides the login and logout times. So, I was able to use that to calculate how much time the computers are being used. This was very handy because there was data from October 2010 to June 2011. I went back a few days later and discovered the log files had been purged all except a few weeks of data. Is there any way to prevent them from being purged? Or, can I increase the size of the retained system.log file? What's the point of a log file tracking events if it's only going to be deleted? Alternatively there are programs designed to keep track of computer usage such as login and logout times as well as user usage by application. Would you recommend one of these?

Thanks for bringing the typo to my attention. I've corrected that now. I'm reminded of the phenomenon by which we see and read words as groups of letters regardless of their positioning.
I've not really had any specific system problems that cause huge log files. However, sometimes when diagnosing problems it's nice to have a long period of time to examine possible issues.
Regarding your #3, opening .bz2 files... Have you saved these log files from Console and then tried opening them? It's just bazaar. The file opens to another file, then opens to another file, and so on. You never see the actual file contents. Others have observed the same thing.
Regarding your #4, I created the script you mention. It's described here:
http://www.resourcesforlife.com/docs/item4103
However, I'd like to just go ahead and use the existing system.log events.
Greg

Is there a log of files/folders deleted from server?

Is there a log of files/folders deleted from our server that I can look at?

Hi again Christiaan, I'd be wary of upgrading your server just for this feature. This article mentions the pitfalls of the different server setups, loss of server preferences when upgrading etc...
The benefits of having file and folder creation/deletion logged could be easily outweighed by the loss of auto setup of users mail and the other features that 'just work' in a standard install.
Cheers

Logs for File Deletion?

Similar Messages

Maybe you are looking for