I can look to see if you have auditctl on your system.
----- Original Message ----- From: Donald Russell [[email protected]] Sent: 06/10/2010 02:14 PM MST To: [email protected] Subject: How to determine who or what changed directory ownership I've recently inherited a Redhat 5.4 system and am not terribly familiar with the application running on it. :-( A directory ownership changes periodically from aa:bb to cc:cc That causes grief because process that try to write to that directory fail due to permission problems. Am I correct that the culprit must be running as root in order to change the ownership that way, or could user "aa" or a member of group "bb: change the ownership to cc:cc? The permissions on the directory are 755 (drwxr_xr_x) sub-directories/files are not altered. Next question... and this is the fun one... is there a way to log who/what changes the file ownership... those events don't get logged in /var/log/messages Any suggestions are greatly appreciated. --- Hey! Hey! You! You! Get off of my cloud! http://news.cnet.com/8301-13578_3-20002423-38.html ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390 ---------------------------------------------------------------------- For more information on Linux on System z, visit http://wiki.linuxvm.org/ Please consider the environment before printing this email. Visit our website at http://www.nyse.com **************************************************** Note: The information contained in this message and any attachment to it is privileged, confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender immediately by replying to the message, and please delete it from your system. Thank you. NYSE Euronext.
