On Wed, 14 Dec 2016 02:16:08 -0600, Baby Eklavya wrote: > >When working through omvs shell, our home has a .sh_history file that records >what was done. But what if it is done from Ishell ? Do we have a similar place >where we can see the history of what was done on Ishell ? > >Why I am asking this question is because we had a weird issue recently where >our /SYSTEM got deleted from the root and /SYSTEM/etc and /SYSTEM//tmp was >taken to a different mount point . We have no clue who might have deleted >/SYSTEM . We tried looking at the .sh_history of each user , but that didn't >show anything . So I am assuming it must have happened from Ish . Any thoughts >on how to solve this would be highly appreciated . > >Btw , we are on z/os 2.1 and are not on a shared ZFS environment . > Or, it might have been done from a program, such as Rexx "address SYSCALL" which would leave no trace in any .sh_history file, or the perpetrator could have set the history count to a small value, or ...
SMF? -- gil ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
