Chad Gilles wrote:
>
> Here's a kicker for you all,
>
>   Is there a way to determine who deleted a file on my system. Is there
> a product or scheme I could put in place to help make this determination
> for future deletes?
>

File Deletion (like CI :PURGE or shell >rm) is accomplish via the
Intrinsic call FCLOSE(<fnum>,4). System Logging has event #105 and 160
to track FCLOSE of files by date,time,logon string and dispostion;
LOGTOOL can be used to display these records.  Unfortunately this will
generate a LOT of data as EVERY file close on the system will be tracked
(could also be a small performance hit)...

Jim
My opinions/mistakes not my employeer's