trace deleted users

I'm running Netware 6.5SP2 with Zenworks 6.5 and dirxml 2.0.1

We just had a a big problem with users that were delted. How can i trace
this back to the guilty user or process? At that same moment i was
experimenting with the second network interface on this server i could
conclude that the problem of a whole bunch of users getting deleted (some
thousands) and the experiment with the network interface are related but
that seems so unlogial. We have dirxml running for user creation, but it's
only used to create and update.

Before i go out and blame some collegue of myself i need to figure this out
and i would be grateful to get some help. Here are my logfiles from the
moment of the crime/accident. I managed to trace this far because some
users's were logged in and their connection was terminited. It starts with
user 0100465.

22/10/2004 16:22:06 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [TCP 10.02.01.50:0524] has been registered as an
NCP Service Address.

22/10/2004 16:22:07 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [UDP 10.02.01.50:0524] has been registered as an
NCP Service Address.

22/10/2004 16:22:08 : CE1000-7.34-0
Severity = 0 Locus = 4 Class = 5 ID = 0x1070000
CE1000-NW-000-Adapter 2-Board 2:
 Link is down.

22/10/2004 16:22:10 : CE1000-7.34-0
Severity = 0 Locus = 4 Class = 5 ID = 0x1070000
CE1000-NW-000-Adapter 2-Board 2:
 Link is up. 1000 Mbs Full Duplex

22/10/2004 16:25:40 : CE1000-7.34-0
Severity = 0 Locus = 4 Class = 5 ID = 0x1070000
CE1000-NW-000-Adapter 2-Board 2:
 Link is down.

22/10/2004 16:26:15 : CE1000-7.34-0
Severity = 0 Locus = 4 Class = 5 ID = 0x1070000
CE1000-NW-000-Adapter 2-Board 2:
 Link is up. 100 Mbs Half Duplex

22/10/2004 16:44:01 : TCPIP-6.57-110
Severity = 1
Unbound local IP address 10.18.1.50 from board 1.

22/10/2004 16:44:01 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [UDP 10.18.01.50:0524] has been deregistered as an
NCP Service Address.

22/10/2004 16:44:01 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [TCP 10.18.01.50:0524] has been deregistered as an
NCP Service Address.

22/10/2004 16:44:03 : TCPIP-6.57-110
Severity = 1
Unbound local IP address 10.2.1.50 from board 2.

22/10/2004 16:44:03 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [UDP 10.02.01.50:0524] has been deregistered as an
NCP Service Address.

22/10/2004 16:44:03 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [TCP 10.02.01.50:0524] has been deregistered as an
NCP Service Address.

22/10/2004 16:44:05 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [TCP 10.18.01.50:0524] has been registered as an
NCP Service Address.

22/10/2004 16:44:05 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [UDP 10.18.01.50:0524] has been registered as an
NCP Service Address.

22/10/2004 16:44:06 : CE1000-7.34-0
Severity = 0 Locus = 4 Class = 5 ID = 0x1070000
CE1000-NW-000-Adapter 1-Board 1:
 Link is up. 100 Mbs Full Duplex

22/10/2004 16:47:58 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [TCP 10.02.01.50:0524] has been registered as an
NCP Service Address.

22/10/2004 16:47:58 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [UDP 10.02.01.50:0524] has been registered as an
NCP Service Address.

22/10/2004 16:48:00 : CE1000-7.34-0
Severity = 0 Locus = 4 Class = 5 ID = 0x1070000
CE1000-NW-000-Adapter 2-Board 2:
 Link is up. 100 Mbs Half Duplex

22/10/2004 16:51:24 : TCPIP-6.57-110
Severity = 1
Unbound local IP address 10.18.1.50 from board 1.

22/10/2004 16:51:24 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [UDP 10.18.01.50:0524] has been deregistered as an
NCP Service Address.

22/10/2004 16:51:24 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [TCP 10.18.01.50:0524] has been deregistered as an
NCP Service Address.

22/10/2004 16:51:26 : TCPIP-6.57-110
Severity = 1
Unbound local IP address 10.2.1.50 from board 2.

22/10/2004 16:51:26 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [UDP 10.02.01.50:0524] has been deregistered as an
NCP Service Address.

22/10/2004 16:51:26 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [TCP 10.02.01.50:0524] has been deregistered as an
NCP Service Address.

22/10/2004 16:51:28 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [TCP 10.18.01.50:0524] has been registered as an
NCP Service Address.

22/10/2004 16:51:28 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [UDP 10.18.01.50:0524] has been registered as an
NCP Service Address.

22/10/2004 16:51:30 : CE1000-7.34-0
Severity = 0 Locus = 4 Class = 5 ID = 0x1070000
CE1000-NW-000-Adapter 1-Board 1:
 Link is up. 100 Mbs Full Duplex

22/10/2004 17:15:38 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [TCP 10.02.01.50:0524] has been registered as an
NCP Service Address.

22/10/2004 17:15:38 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [UDP 10.02.01.50:0524] has been registered as an
NCP Service Address.

22/10/2004 17:15:40 : CE1000-7.34-0
Severity = 0 Locus = 4 Class = 5 ID = 0x1070000
CE1000-NW-000-Adapter 2-Board 2:
 Link is up. 100 Mbs Half Duplex

22/10/2004 17:23:20 : TCPIP-6.57-110
Severity = 1
Unbound local IP address 10.18.1.50 from board 1.

22/10/2004 17:23:20 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [UDP 10.18.01.50:0524] has been deregistered as an
NCP Service Address.

22/10/2004 17:23:20 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [TCP 10.18.01.50:0524] has been deregistered as an
NCP Service Address.

22/10/2004 17:23:22 : TCPIP-6.57-110
Severity = 1
Unbound local IP address 10.2.1.50 from board 2.

22/10/2004 17:23:22 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [UDP 10.02.01.50:0524] has been deregistered as an
NCP Service Address.

22/10/2004 17:23:22 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [TCP 10.02.01.50:0524] has been deregistered as an
NCP Service Address.

22/10/2004 17:23:25 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [TCP 10.18.01.50:0524] has been registered as an
NCP Service Address.

22/10/2004 17:23:25 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [UDP 10.18.01.50:0524] has been registered as an
NCP Service Address.

22/10/2004 17:23:26 : CE1000-7.34-0
Severity = 0 Locus = 4 Class = 5 ID = 0x1070000
CE1000-NW-000-Adapter 1-Board 1:
 Link is up. 100 Mbs Full Duplex

22/10/2004 17:23:53 : FILESYS-5.13--1210607030
Severity = 4 Locus = 8 Class = 19
Account 0100465 deleted by user TELOS on station 0
1 active connection terminated

22/10/2004 17:24:35 : FILESYS-5.13--1210607030
Severity = 4 Locus = 8 Class = 19
Account 0200399 deleted by user TELOS on station 0
1 active connection terminated

22/10/2004 17:25:11 : FILESYS-5.13--1210607030
Severity = 4 Locus = 8 Class = 19
Account 0201938 deleted by user TELOS on station 0
1 active connection terminated

22/10/2004 17:25:41 : FILESYS-5.13--1210606954
Severity = 4 Locus = 8 Class = 19
Account 0300605 deleted by user TELOS on station 0
2 active connections terminated

22/10/2004 17:25:48 : INETCFG-6.50-1
Severity = 1
Inetcfg cannot load when this server is being remotely configured
through NetWare Remote Manager

22/10/2004 17:26:56 : FILESYS-5.13--1210607030
Severity = 4 Locus = 8 Class = 19
Account 0400414 deleted by user TELOS on station 0
1 active connection terminated

22/10/2004 17:27:21 : FILESYS-5.13--1210607030
Severity = 4 Locus = 8 Class = 19
Account 0401006 deleted by user TELOS on station 0
1 active connection terminated

22/10/2004 17:27:40 : FILESYS-5.13--1210607030
Severity = 4 Locus = 8 Class = 19
Account 0401524 deleted by user TELOS on station 0
1 active connection terminated

22/10/2004 17:27:49 : FILESYS-5.13--1210606954
Severity = 4 Locus = 8 Class = 19
Account 0401710 deleted by user TELOS on station 0
2 active connections terminated

22/10/2004 17:27:57 : FILESYS-5.13--1210607030
Severity = 4 Locus = 8 Class = 19
Account 0401930 deleted by user TELOS on station 0
1 active connection terminated

22/10/2004 17:28:06 : FILESYS-5.13--1210606954
Severity = 4 Locus = 8 Class = 19
Account 0402223 deleted by user TELOS on station 0
2 active connections terminated

22/10/2004 17:29:20 : INETCFG-6.50-1
Severity = 1
Inetcfg cannot load when this server is being remotely configured
through NetWare Remote Manager

22/10/2004 17:39:12 : TCPIP-6.57-110
Severity = 1
Unbound local IP address 10.18.1.50 from board 1.

22/10/2004 17:39:12 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [UDP 10.18.01.50:0524] has been deregistered as an
NCP Service Address.

22/10/2004 17:39:12 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [TCP 10.18.01.50:0524] has been deregistered as an
NCP Service Address.

22/10/2004 17:39:15 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [TCP 10.18.01.50:0524] has been registered as an
NCP Service Address.

22/10/2004 17:39:15 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [UDP 10.18.01.50:0524] has been registered as an
NCP Service Address.

22/10/2004 17:39:36 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [TCP 10.02.01.50:0524] has been registered as an
NCP Service Address.

22/10/2004 17:39:36 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [UDP 10.02.01.50:0524] has been registered as an
NCP Service Address.

22/10/2004 17:39:36 : TCPIP-6.57-78
Severity = 1
This Server and the system having hardware address 00-10-5A-D7-2C-54
have conflict for IP address 10.2.1.50.

22/10/2004 17:39:36 : TCPIP-6.57-110
Severity = 1
Unbound local IP address 10.2.1.50 from board 1.

22/10/2004 17:39:53 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [UDP 10.02.01.50:0524] has been deregistered as an
NCP Service Address.

22/10/2004 17:39:53 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [TCP 10.02.01.50:0524] has been deregistered as an
NCP Service Address.

22/10/2004 17:39:54 : TCPIP-6.57-110
Severity = 1
Unbound local IP address 10.18.1.50 from board 1.

22/10/2004 17:39:54 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [UDP 10.18.01.50:0524] has been deregistered as an
NCP Service Address.

22/10/2004 17:39:54 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [TCP 10.18.01.50:0524] has been deregistered as an
NCP Service Address.

22/10/2004 17:39:59 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [TCP 10.18.01.50:0524] has been registered as an
NCP Service Address.

22/10/2004 17:39:59 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [UDP 10.18.01.50:0524] has been registered as an
NCP Service Address.

22/10/2004 17:41:22 : CE1000-7.34-0
Severity = 0 Locus = 4 Class = 5 ID = 0x1070000
CE1000-NW-000-Adapter 2-Board 2:
 Link is up. 100 Mbs Half Duplex

22/10/2004 17:50:42 : TCPIP-6.57-110
Severity = 1
Unbound local IP address 10.18.1.50 from board 1.

22/10/2004 17:50:42 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [UDP 10.18.01.50:0524] has been deregistered as an
NCP Service Address.

22/10/2004 17:50:42 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [TCP 10.18.01.50:0524] has been deregistered as an
NCP Service Address.

22/10/2004 17:50:47 : CE1000-7.34-0
Severity = 0 Locus = 4 Class = 5 ID = 0x1070000
CE1000-NW-000-Adapter 1-Board 1:
 Link is up. 100 Mbs Full Duplex

22/10/2004 17:52:29 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [TCP 10.18.01.50:0524] has been registered as an
NCP Service Address.

22/10/2004 17:52:29 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [UDP 10.18.01.50:0524] has been registered as an
NCP Service Address.

22/10/2004 17:52:29 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [TCP 10.02.01.50:0524] has been registered as an
NCP Service Address.

22/10/2004 17:52:29 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [UDP 10.02.01.50:0524] has been registered as an
NCP Service Address.

22/10/2004 17:52:31 : CE1000-7.34-0
Severity = 0 Locus = 4 Class = 5 ID = 0x1070000
CE1000-NW-000-Adapter 2-Board 2:
 Link is up. 100 Mbs Half Duplex

22/10/2004 17:58:23 : TCPIP-6.57-110
Severity = 1
Unbound local IP address 10.18.1.50 from board 1.

22/10/2004 17:58:23 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [UDP 10.18.01.50:0524] has been deregistered as an
NCP Service Address.

22/10/2004 17:58:23 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [TCP 10.18.01.50:0524] has been deregistered as an
NCP Service Address.

22/10/2004 17:58:25 : TCPIP-6.57-110
Severity = 1
Unbound local IP address 10.2.1.50 from board 2.

22/10/2004 17:58:25 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [UDP 10.02.01.50:0524] has been deregistered as an
NCP Service Address.

22/10/2004 17:58:25 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [TCP 10.02.01.50:0524] has been deregistered as an
NCP Service Address.

22/10/2004 17:58:26 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [TCP 10.18.01.50:0524] has been registered as an
NCP Service Address.

22/10/2004 17:58:26 : NCP-5.60-66
Severity = 0 Locus = 14 Class = 19
The Network Address [UDP 10.18.01.50:0524] has been registered as an
NCP Service Address.

22/10/2004 17:58:28 : CE1000-7.34-0
Severity = 0 Locus = 4 Class = 5 ID = 0x1070000
CE1000-NW-000-Adapter 1-Board 1:
 Link is up. 100 Mbs Full Duplex