On Wed, Dec 14, 2016 at 9:01 AM, Paul Gilmartin < [email protected]> wrote:
> On Wed, 14 Dec 2016 02:16:08 -0600, Baby Eklavya wrote: > > > >When working through omvs shell, our home has a .sh_history file that > records what was done. But what if it is done from Ishell ? Do we have a > similar place where we can see the history of what was done on Ishell ? > > > >Why I am asking this question is because we had a weird issue recently > where our /SYSTEM got deleted from the root and /SYSTEM/etc and > /SYSTEM//tmp was taken to a different mount point . We have no clue who > might have deleted /SYSTEM . We tried looking at the .sh_history of each > user , but that didn't show anything . So I am assuming it must have > happened from Ish . Any thoughts on how to solve this would be highly > appreciated . > > > >Btw , we are on z/os 2.1 and are not on a shared ZFS environment . > > > Or, it might have been done from a program, such as Rexx "address SYSCALL" > which would leave no trace in any .sh_history file, or the perpetrator > could have > set the history count to a small value, or ... > > SMF? > That should work. There should be type 92, subtype 14, records, if they are being recorded. ref: http://www.ibm.com/support/knowledgecenter/SSLTBW_2.1.0/com.ibm.zos.v2r1.ieag200/iea3g2_Subtype_143.htm > > -- gil > > ---------------------------------------------------------------------- > For IBM-MAIN subscribe / signoff / archive access instructions, > send email to [email protected] with the message: INFO IBM-MAIN > -- Heisenberg may have been here. http://xkcd.com/1770/ Maranatha! <>< John McKown ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
