While this isn't perfect, it is usually pretty accurate: check the
timestamp of the policy directory to see when it was last modified and then
compare that to last to see who logged in around that time. It doesn't
always work and won't work if users log in as root, but as I said, it tends
to work for us.



If you're windows, Simon's suggestion should also work.



-Rusty



________________________________



From: veritas-bu-bounces AT mailman.eng.auburn DOT edu
[mailto:veritas-bu-bounces AT mailman.eng.auburn DOT edu] On Behalf Of "Ed 
Wilts"
<ewilts AT ewilts DOT org>

Sent: Tuesday, February 12, 2008 11:09 AM

To: "Tanveer Ahmed" <ahmed.tanveer AT ubl.com DOT pk>

Cc: veritas-bu AT mailman.eng.auburn DOT edu

Subject: Re: [Veritas-bu] who has deleted or de-activated a policy?





On Feb 11, 2008 11:09 PM, Tanveer Ahmed <ahmed.tanveer AT ubl.com DOT pk> wrote:





      Is there a any way to determine who has deleted or de-activated a
policy?





Technically, no.  And since the people making policy changes typically also
have administrative rights to the systems, it won't be foolproof anyway
(unless you send these logs off to a secure syslog server somewhere).





We have a text file containing our own changelog.  If we catch somebody not
updating the changelog when he's made a change, we let him have it.  Peer
pressure works fairly well.



   ..../Ed





--

Ed Wilts, Mounds View, MN, USA

mailto:ewilts AT ewilts DOT org _______________________________________________

Veritas-bu maillist - Veritas-bu AT mailman.eng.auburn DOT edu

http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu




_______________________________________________
Veritas-bu maillist  -  Veritas-bu AT mailman.eng.auburn DOT edu
http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu