How to trace deleted files in SAP Application server

[Former Member]

Hi BASIS Expert,

There was some files written in SAP application directory. Every 60 seconds there is an RFC to call to pick, move and delete. and each stage we are maintaining log in our custom table.

As per our log the file has been created but physically no file.

Can we know the past history of files(which are created / deleted) under a directory on two weeks back?

Please advise.

Regards,

Vadamalai

[Former Member]

Hi Vadamalai,

If you are using Linux OS, you can check debugfs -w <filesystem_Name>

At debugfs prompt, type lsdel
This will give you details of the files that were deleted recently. Using the inode details, you can get more details about the file that was deleted.

Hope it helps you.

Regards,

Harsha Naik

[cris_hansen]

Hello Vadamalai,

I think this is more suitable for an OS-level tool.

For Windows you can use the Audit Policy to "Audit Object Access".

For Linux you can use audit daemon.

Kind regards,

Cris

[Shubham1]

https://help.sap.com/saphelp_nw70/helpdata/en/1f/83114c4bc511d189750000e8322d00/content.htm

Hello

Try SAP system trace (ST01) by which you can monitor following components  :

1. Authorization checks
2. Kernel functions
3. Kernel Module
4. SQL trace
5. Table buffers
6. RFC calls
7. Lock operations (client side)

Above link is helpful.

Shubham

[Former Member]

Hi,

Do you think old files(file names) can be retrieved? from your steps?

I just wanted to know the file names with time stamp for two weeks back(which are deleted now).

Regards,

A Vadamalai.

[Shubham1]

https://scn.sap.com/thread/739425

hello

You need to take ABAP support /code for old files retrieval.

Refer above thread.

Shubham