Log for deleted files

Question

Is there ay way to check if user delete any files or folders? I mean log in user, it would be perfect if I can (admin) see all deleting action.

Answer 1

You could also create a wrapper script. And replace /bin/rm with it. So that if a user
on the system run 'rm' to remove files, the entry would be written to a log file of you
choice. The following is a quick hack.
#!/bin/bash
PS=/bin/ps
PS_OPTIONS=" -p $$ -o uid=EffectiveUser,user,ruid=RealUserName,ruser,args,uid"
ECHO=/bin/echo
RM=/bin/rm.real # The real rm(1) command.
LOGFILE=/tmp/hold
${PS} ${PS_OPTIONS} >> ${LOGFILE}
${RM} ${1}
$ rm testfile1
$ cat /tmp/hold
EffectiveUser USER RealUserName RUSER ARGS UID
501 andya 501 andya /bin/bash rm testfile1 501