How does one find who or what (service) deleted a particular file or folder in Solaris?

Question

Is there any tool or logs which could give information about it? Also, if there is no way to find out the above then... can I do something which informs me when someone or some service tried to delete the folder.

Answer 1

This small Dtrace script will easily log every file deletion in the system:

dtrace -qn 'syscall::unlink*:entry { printf("%d, %s, %s\n", uid, execname, copyinstr(arg0));}
syscall::fsat:entry  /arg0 == 5 / { printf("%d, %s, %s\n", uid, execname, copyinstr(arg2));}'

Answer 2

AFAIK there is no "out the box" solution but you could use an event driven file watcher for file system events (on the directory its in) - then look up the offending program(s) that match the handle.

If you need such an application then it may be worth asking on StackOverflow as you cannot be the only with such a need.