Originally posted by: jethro88

Hi All, thanks in advance for the help.

System: AIX 6.1

Recently someone log in to my system and deleted the oracle database, with root user account.

I have checked the history command saved under / directory which is .bash_history and i can only find the command executed "rm -rf /oracle" in sequence but without time tag (as shown in the attached file).

With the command "last root", I have checked the IP logged in to system,  however i still cannot pin point which user did it because there are a few ip logged in during that time.

May i know is there any other way to trace the IP login to the system with command executed? or how can i get the history command with time tag?

Thank You.

Originally posted by: ppereira

Hi; I don't think that you will be able to get that without additional configuration on the system.

Check out this post https://www.ibm.com/developerworks/community/forums/html/topic?id=77777777-0000-0000-0000-000014289119

Regards.

Pablo.

Originally posted by: YannickBergeron

To prevent your situation, ie difficulty to find trace of what happened and who did that:

root remote login should be disabled

provide root access with sudo

each user using root with sudo should have their own history with timestamp

sudo logging could happen on a remote system with syslog

etc.

at the end, if you provide a user root access, he can do harm and delete his traces. But if he's professional, the trace will remains, you'll be able to understand what happened and analyze why it happended and how it could be prevented, without bashing on the admin who did it.