How to Use auditd to Find Out Who Deleted a File in Linux

Updated: 28 September 2026 · Applies to: Linux audit 3.1 and 4.0 on AlmaLinux and Rocky Linux 9 and 10, RHEL 9 and 10, Ubuntu 24.04 and 26.04, Debian 13 (x86_64 servers)

When files disappear from a server, the audit system can tell you who deleted them, when, and with which program. You add a rule that records every delete and rename in a folder; from then on, each event is logged with the user, the process and the path. The audit system cannot tell you about deletions that happened before the rule existed.

1. Install and start auditd

dnf install audit          # AlmaLinux, Rocky Linux, RHEL (usually installed)
apt install auditd         # Ubuntu, Debian
systemctl enable --now auditd

2. Add a rule for deletions in one folder

Create /etc/audit/rules.d/50-delete.rules:

-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat,renameat2 -F dir=/var/www -F key=www-delete
-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat,renameat2 -F dir=/var/www -F key=www-delete

The rule catches the system calls that delete (unlink, unlinkat) or move away (rename, renameat, renameat2, which current versions of mv use) files anywhere under /var/www. The second line covers 32-bit programs. The key is a label you search for later.

3. Load the rules

augenrules --load
auditctl -l

auditctl -l should list your two rules. Rules in /etc/audit/rules.d/ are loaded again at every boot.

4. Find out who deleted a file

ausearch -k www-delete -i
ausearch -k www-delete -i --start today | grep -E 'name=|exe=|auid='

In each event, auid is the user who originally logged in (it stays the same after sudo or su), uid the user the program ran as, exe the program, and the name= lines the file affected. -i turns numbers into user names. For a summary: aureport -f -i --start today.

Watch a single file instead

For one important file, a watch rule is simpler. It logs writes and attribute changes to the file:

-w /etc/nginx/nginx.conf -p wa -k nginx-conf

Deleting a file is a change to its folder, so for deletions the syscall rule above is the reliable choice.

Tips

• Keep rules narrow. Watching deletions on the whole disk creates a lot of log data on a busy server.
• The audit log is /var/log/audit/audit.log; its size and rotation are set in /etc/audit/auditd.conf.
• To remove a rule, delete its file and run augenrules --load.

Official documentation: Auditing the system (Red Hat) and audit.rules manual page.