On 27/01/2019 15.08, Adam Mizerski wrote:
different (and much simpler) question - did you check journal or
/var/log/messages? If the user was deleted with "userdel", you should
find something about this in the log. If so, check if other events,
updates, whatever happened at the same time.
In journal - nothing suspicious (I can share some of my logs privately,
if you want). /var/log/messages? Man, I haven't seed that file in ages :)
I grepped whole /var/log with some keywords and all I found is
/var/log/audit/audit.log that contains all my useradd actions, but
nothing related to deleting freenet user (I checked by name and id).
The user could be deleted by editing the passwd file directly with any
editor, leaving no trace. Well, some editors would leave a bak or ~ file.
Cheers / Saludos,
Carlos E. R.
(from 15.0 x86_64 at Telcontar)