It's been my experiences that both log.nsf and the console.log will show when a database is deleted.

Isn't creation and deletions of applications registered by default in Domino Domain Monitoring (ddm.nsf)?

Thanks Mark and Pontus,

but I didn't find any event in log.nsf and ddm either.

So why?

Scenario, an user "unfortunately" delete a file from notes client.

Where is registered?

Did he delete a file that was located on the server? Or delete a file that was located on his client?

If it was located on the server, the log.nsf should record that information. For example, I deleted a file yesterday:

10/14/2014 12:39:37   Database mail\xxxxxxxxx.nsf deleted by Mark A Taylor/xxxxxxxxxx/North America/xxxxxxxxx

In order for a user to delete the file, they'd have to have Manager access to that file.

If the file was located on the client, I would expect that the client's log.nsf or Console.log (if enabled) would show it.

SecurTrac's Intrusion Detection Monitor may meet your needs.

http://www.extracomm.com/securtrac