You could run the audit facility. http://shareew.prod.web.sba.com/client_files/callpapers/attach/SHARE_in_Denver/S9203SW163007.pdf
Marcy "This message may contain confidential and/or privileged information. If you are not the addressee or authorized to receive this for the addressee, you must not use, copy, disclose, or take any action based on this message or any information herein. If you have received this message in error, please advise the sender immediately by reply e-mail and delete this message. Thank you for your cooperation." -----Original Message----- From: Linux on 390 Port [mailto:[email protected]] On Behalf Of Donald Russell Sent: Thursday, June 10, 2010 2:15 PM To: [email protected] Subject: [LINUX-390] How to determine who or what changed directory ownership I've recently inherited a Redhat 5.4 system and am not terribly familiar with the application running on it. :-( A directory ownership changes periodically from aa:bb to cc:cc That causes grief because process that try to write to that directory fail due to permission problems. Am I correct that the culprit must be running as root in order to change the ownership that way, or could user "aa" or a member of group "bb: change the ownership to cc:cc? The permissions on the directory are 755 (drwxr_xr_x) sub-directories/files are not altered. Next question... and this is the fun one... is there a way to log who/what changes the file ownership... those events don't get logged in /var/log/messages Any suggestions are greatly appreciated. --- Hey! Hey! You! You! Get off of my cloud! http://news.cnet.com/8301-13578_3-20002423-38.html ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390 ---------------------------------------------------------------------- For more information on Linux on System z, visit http://wiki.linuxvm.org/ ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390 ---------------------------------------------------------------------- For more information on Linux on System z, visit http://wiki.linuxvm.org/
