Monitor User Activities

Question

We recently had a mischievous user delete some key files from a shared volume on a client. We were able to recover the files, but never found out who deleted the files and caused us the downtime.
Is there a solution (built into OS X or third-party) that will allow me to log and view what my users have been up to? I know I can see what they are currently doing in RD, but it's what they do when were not there we need to know about.
Even better, how could I set proper ACLs and permissions on local volumes without making files unreadable? This way I could stop people deleting others work. I initally set permissions on the local volumes - and they were correct - but programs such as iMovie kept failing to read/write properly.
Cheers
james
12" iBook G4 : 1.2GHZ/768MB/60GB/APX/Combo   Mac OS X (10.4.7)   1G iPod 5GB, 5G iPod 30GB (white); PowerMac G4 DP Server (Tiger)

Answer 1

To do this with standard file permissions, open the Terminal in the /Applications/Utilities/ folder and enter the following:
sudo chmod 1775
followed by a space; next, drag the folder into the Terminal window, press Enter, and type in your administrator password, which won't produce anything on the screen while it is being typed. After this is done, items in the folder can only be renamed, moved out of the folder, or deleted by the item's owner, the folder's owner, or root. The number as written will give the owner and group Read & Write access to the folder and all accounts Read Only access; to set the permissions up differently, use 0(no access), 3(write only), 5(read only), or 7(read and write) in the second through fourth positions. The positions are owner, group, and others respectively starting from the second place. For a folder, the execute bit should be turned on if either the read or write bits are turned on; this bit is on whenever the number represented is odd.
After setting this up, anyone with administrator access can use sudo or the Finder to move other people's documents out of the folder; the commands run by sudo are logged by default. You should also change the folder's owner to system in the Finder after running the command. This command will not prevent someone from opening a document and deleting all of the text inside, but some applications, such as TextEdit, won't be able to save the change if the file is owned by another account.
(15527)