You might try something like this:
grep "deluser" /home/*/.bash_history /root/.bash_history
سؤال
I have a regular username on a linux machine. I also have the root privilege. Today I found my username was deleted. That is, if I logged in as root and then ran
su myusername
The systems said "myusername" does not exist. I checked file /etc/passwd and "myusername" was not there.
My question is, is there anyway to find out who deleted "myusername"?
المحلول
You might try something like this:
grep "deluser" /home/*/.bash_history /root/.bash_history