our environment : Oracle RAC 220.127.116.11 on Oracle Linux Server 6.8
Recently we had some cluster issue. And some one has informed my management that the recent problem occured due to some one changed private interconnect ip of a node in the RAC.
as i am not a linux admin, kindly some one help me on how to find proof / log of this ip change ?
Thanks in advance
root access is needed to make network changes.
Thus you need to investigate what was changed (e.g. file eth1.cfg was updated with new static IP), look at the kernel and CRS logs for approximately when the network change come into effect, and examine the audit logs for root access around that time, look at shell history for incriminating commands, and so on. Assuming these logs are available.
If you don't know Linux and GI, I would not bother - rather get an expert to examine forensics.