How to get logs for file deletion from Linux environment

[kbhardwaj]

I have been searching for logs specific to file deletion from Linux servers. I've searched audit logs but do not get any relevant logs . I have also searched in auth folder. Can anyone help me identify which folder to look in for logs that are being ingested into Splunk?

[afamoyib]

If you can't use something like inotify to update you. The next best thing i can think of is to monitor the history command for any time the rm command is called. That is the next best thing i can think of. This way you can setup a search for anytime the remove command is used and this can be a report or an alert based on the condition you would like

[jplumsdaine22]

It is unlikely this is being logged by default on a standard *nix system. Your sysadmins should be able to set something up for you (have a google, it depends on your distribution) and then its just a matter of adding those logs to Splunk.

If the files are on some kind of filer that may be a different matter, again it will depend on the vendor.