Track which user changed files - auditing - logging

Question

I work at a school where our OSx 10.6 server is sharing out files to open directory users.  Some of the files require a collaborative effort from a group of students, so they are given read/write access to them.  We've recently had trouble with someone in the group intentionally sabotaging files (InDesign files to be exact).  I've found a way to track times/dates that files were changed, but not who changed them.  Is there a way to track/audit this on the server?  The kids do authenticate as themselves when accessing the SharePoint. If not, are their any good utilities that would provide this functionality that you could recommend?

Answer 1

Here is what you can find using flashback transaction query.
SYS@10G>desc flashback_transaction_query
Name                                      Null?    Type
XID                                                RAW(8)
START_SCN                                          NUMBER
START_TIMESTAMP                                    DATE
COMMIT_SCN                                         NUMBER
COMMIT_TIMESTAMP                                   DATE
LOGON_USER                                         VARCHAR2(30)
UNDO_CHANGE#                                       NUMBER
OPERATION                                          VARCHAR2(32)
TABLE_NAME                                         VARCHAR2(256)
TABLE_OWNER                                        VARCHAR2(32)
ROW_ID                                             VARCHAR2(19)
UNDO_SQL                                           VARCHAR2(4000)You can see the LOGON_USER which helps if you are using different database accounts for your users. If you are using a single database user for your application you cannot see which specific application user made the change. You need auditing for that.